That's oddly reductionist. People have a wide range of risk profiles and amount of time they are able to dedicate to different things. One can be an expert in s

That's oddly reductionist. People have a wide range of risk profiles and amount of time they are able to dedicate to different things. One can be an expert in something and still not have time to implement all the security they'd like, or could mainly implement mitigations against impersonal/dragnet attacks rather than well-funded (in time or money) directed attacks.