I suppose the issue here is that many of the people who might "compromise" one's browsing session don't fit the model of an evil attacker. They might be friend

I suppose the issue here is that many of the people who might "compromise" one's browsing session don't fit the model of an evil attacker. They might be friendly pranksters, or unfriendly but not invested enough in the "attack" to go to much effort to perform it. Part of the reason it makes a difference, as noted, is most people's lack of technical knowledge, which might not be a good thing to rely on (though it will probably continue to exist for the foreseeable future), but even with the knowledge that alternatives exist, it feels more evil to go after them. In computer security, it's common to look down on security measures that are bypassable, even if they have some deterrent effect, because hackers wise up fast, and the false sense of security the measures tend to provide is actively harmful. But there's a difference between hackers and the general population... The other comment in this thread about locking doors is a good analogy. The chance that locking my door (in a house with many ground-floor windows and no home security system) will deter an actual burglar is nil. But it could certainly deter some strange neighbor from sneaking in and perhaps stealing things. on the other hand - justinschuh mentioned that they've "literally spent years evaluating it and have quite a bit of data to inform our position". Opinions formed off the top of our heads don't mean that much.