I don't intend to blame them, I'm just making an observation.

The fact that they don't know is a problem in itself too, and spreading awareness about cybersecurity and teaching general tech literacy and common sense is not done as much as it should be.

It's exactly like you say. They don't know, and how would they? No one is ever giving them the information they need.