I would bet most of this users clicking things they should not. recently my company put out a phishing email and people clicked on it and then started a thread on the internal forums about how mad they were the company would do this (they had to take extra training if the fell for it). Another co worker was telling me about his old position where he put the thumb drives in parking lots and people would pick them up and plug them into their work computer, and the would get mad that their security team did this exercise and caught them.

Yes a lot can still be done with security on machines and traffic, etc.... But the human factor is hard to control and fix. If someone sent out a phishing email with a link that said "click here to see magical unicorns jumping over a rainbow", someone would click it, i know poeple i work with who would click it. It gets, frustrating at least for me, since i have a lot to do with security where i am at.