TLDR: They didn’t click any suspicious links.
Whereas doing things wrong (or taking advantage of other people who do things wrong), well that’s fertile soil for good storytelling.
A better summary might be:
There was no silver bullet that fixed everything, rather a vigorous campaign of teaching a security mindset.