It doesn't help that a lot of businesses do the shit that builds the bad habits.

My bank has called me to verify a purchase (as in I called the number on my card and got redirected back to the same person). A variety of businesses routinely send direct action links that immediately request login information. Many online businesses require your phone number for a purchase and immediately opt you in to text messaging without consent. I have received plenty of nuisance texts/emails from places I made an online order with, then made an in-store purchase with the same card.

All that shit teaches people that that shit is normal and legitimate. Disgusting, insecure, privacy invading bullshit is a routine occurrence.

It can happen to anyone, even you! All it takes is for you to be a bit tired, stressed, or have a bit of an emotional response and it can quickly spiral.

Hell, even the guy who came up with the term "phishing" clicked a phishing link at the height of his cyber security career and just barely caught himself before providing info.

These people aren't idiots, they are victims who were tricked.