A good security model doesn't let stupid people do stupid things with warnings. Stupid people ignore warnings.

A good model protects stupid people from themselves.

A password model that says "you MUST have a strong password" protects stupid people from their own stupidity. A model that says you can use bad passwords if you click through warnings is a shite model. Stupid people ignore warnings.

Seriously.