Totally agree, though I'd argue that it's still a software failure if preventing exploits requires every user memorize and follow an onerous list of best practices.

This is where security is actually heavily intertwined with Privacy, by following good privacy principles, you automatically cover a lot of security issues.