Punting responsibility to users is well and good until (for example) their IoT devices start doing damage under the control of Mirai. I’m not saying that a patrician approach is the only solution, but we are not each our own perfectly isolated islands.