> they probably want to cater to the average person, and not just security conscious tech savvy people

Why? The average person is well served by large existing players, whereas security conscious tech people are extremely underserved and often actually willing to pay.

Specific numbers aside, one possible reason is they want to increase adoption to gain user volume, in order to have an effect on the larger ecosystem.

Once you have non-trivial network effects, you could continue to influence the ecosystem (see: MSIE, Firefox in its early days, and Google Chrome). There are probably multiple paths to this. This is one.