I think the subtext of what I wrote in that paragraph was about the additional cognitive load of having to worry about every little action. For most people who are less informed about scams/cybersecurity, there is a lower cognitive load tax on their mind/attention (but that lower cognitive load results in less skepticism and more susceptibility to scams). Or put another way, the heuristics they use are at a different point on the tradeoff curve between effort/resources and accuracy.