I'd argue that: - a large part of privacy issues only exist under legitimate use cases - a comparatively smaller but still relevant part of security issues wo

I'd argue that: - a large part of privacy issues only exist under legitimate use cases - a comparatively smaller but still relevant part of security issues would involve attacking (e.g. code injection) a legitimate web application (which the user may already trust) as a first step, and progressing from there - the fact that such few genuine use cases exist makes users much less likely to accept any illegitimate use, since it will be a permission request box that they have never seen before and haven't been desensitized to