Yeah there's a certain amount of effort most people are willing to put in to do something. If it's too high, it won't happen. Yet at the same time a certain baseline is needed to not end up being low hanging fruit for attackers.

I've also seen this, especially in security tools. The usability is often straight out of the 90s which keeps me wondering, who uses this voluntarily?