I think what you are missing is the huge investment the "bad guys" have put into getting people to believe insecure communications are in fact secure.