I think people also need to accept the fact we're never going to engineer a solution to human stupidity. If our society doesn't raise people to be good users, no amount of hardening will stop systems from being compromised.
I've written in-depth about why "don't click untrusted links" is unhelpful: see https://xmppwocky.net/blog.py?page=22