>They just do, just like they bypass HTTPS warnings in browsers.

How could you possibly know this, other than anecdotally?