I think the bigger question is whether this is even worth solving. If people really want to give someone root access and do it willingly, maybe we just say this is out of our purview and allow it. And then, slowly, people will learn. They will be hard lessons but evidently baby proofing the entire world is not really working, so we might just abandon ship on that idea.

> And then, slowly, people will learn

I hope you're right, but I'm not sure they will. The less locked-down WinXP and early Android era was ... really really bad in terms of nontechnical people getting hacked/scammed. And bad actors are also innovating, so the target of what people have to learn is moving: now we have synthetic AI voice scams, easy-to-create full clones of popular websites that harvest credentials, an explosion of 0days that let people run RATs that hassle elders for their MFA codes, and so on.

Like, I'm 100% with you that baby-proofing the world is an unattainable, patronizing, and negative-externality-laden goal. We shouldn't do that. But we shouldn't go full libertarian "you're on your own; toughen up" either; I think we have a lot of data that indicates that the harms of that approach are both high-magnitude and high-volume.

Tell me that when it’s your relative that is out thousands of dollars because they were scammed.