firstly, you're assuming everyone works in an office.

then, that those lessons stick.

then, that malware only affects those who essentially opt into it.

All of these are beyond-stupid assumptions.

PS. not one security training I've had did more than just mention in passing updating your device, if even that. Because guess what, IT departments don't give a choice. They manage that and force-install updates.

Your other weak-ass assumption is that work lessons (if even applied at work) also come home.

Yeah dude, you're just wrong in your thinking. Top to bottom.