They do if they are employed in a non-tiny company where they work at least partially on a computer and paid attention during security training.

Even if I agree with you that the "average person" meets the 3 specific criteria you list (which I don't), I don't believe the claim that the typical security training includes specific instruction in how TLDs and domain registration work, at least not in enough detail for a person to be able to follow the discussion we're having here.

> I don't believe the claim that the typical security training includes specific instruction in how TLDs and domain registration work

Mine just has an animated llama telling me not to click suspicious links in emails