Exactly so, MJ.
And most home users - non-techie gurus the lot of 'em - will just go with the flow on the basis they don't understand any of this stuff. Believe me, clergymen are the worst. Most of my "unscrambling" of PCs is for these fine, caring gentlemen.
I do try to explain why and what, but eyes glaze over quickly. So I set things up as best I can and tell them not to click on anything that says thus, or any e-mail from someone you don't know, and so on. They usually do so within three months.
So it's Firefox with NoScript etc, Zone Alarm, Avast, Adblock+ and so on and so on, and rely on those to look after them.
Gillian's is a different case but in the same mould. She got an e-mail about a DHL parcel and was expecting one. But the e-mail wasn't about HER parcel, and the payload was toxic.