Relatedly, I think a lot of us under-estimate/under-appreciate physical security in our threat models. A desktop tower that never leaves my house and would be a pain for anyone but a dedicated burglar to steal maybe doesn't need the same sort of security/encryption/authentication requirements for physical access in person that a phone or laptop might need. Certainly there are plenty of fears of people targeting me specifically and getting physical access to my house, but there are also more legal protections from some of those. Threat models are all about trade-offs and physical security/physical access restrictions trade-offs can be under-appreciated as places to make choices that can be in your favor.

I understand what you mean but I think maybe your example wasn’t terrific given I think the elderly are actually frequent and vulnerable targets for crims. I’ve actually had scenarios where my parents were unable to log into an account and when I asked why they needed to, it was to give some “support specialist” information they were asking for. Is it a pain in the ass to help your parents install a mobile app sometimes? Yeah I guess. I’m just glad someone didn’t drain their bank account on them.

There is sometimes a point to inconvenience in that it requires time and assessment.