That's a weird treatment of rationality. If users reject security advice because they studied the costs and benefits, and found it unprofitable given the risks

That's a weird treatment of rationality. If users reject security advice because they studied the costs and benefits, and found it unprofitable given the risks, then that's rational. But if users reject security advice because "oh God it's too hard and it's probably not too bad anyway I have nothing to hide, right?", that's not rational. That's ignoring the problem and coincidentally getting the right answer. It's like concluding users are rational for refraining from buying a lottery ticket. It turns out, though, the users didn't actually do any math, and were just too lazy to get up that morning.