Definitely, this is a hard tradeoff to make. Users very often care more about having access to their messages than them being not accessible to authorities/advertisers/etc, and they are very often not very savvy. As you say they also probably don't choose the most secure passwords.

Signal on the other hand sides on the side of security so much that it makes the app purposefully less useable, e.g. with their pin feature. But it doesn't have this backup problem. It's not a situation that has an easy solution atm.

But I think it's important to note that the belief of many users is wrong that end-to-end encryption implies that message content is unavailable to governments unless they get unlocked access to devices of communication partners.