End users aren't expected to care about security and if they do, usually they are in an enterprise setting where it's taken care of automatically by enterprise settings.

Not to say it's good or bad, just not the target market.

VSCode is targeted at a step above the standard end user, but even there extensions are not sand-boxed and the Workspace Trust is a single toggle.

End users should be expected to care about security. They should not be the only guard rail, but they are part of the defense in depth plan.

You do know about all those security training courses HR makes your take every year that you skip over?

Unfortunately they are there for compliance, unless there is a strong IT in place, which then again, makes them hated by everyone else.

I agree wholeheartedly with this article and this is something I'm struggling with my daughter about: the worst thing anybody can say is no and in some cases, they already said no. If you ask (or ask again), you might get a really good answer or more.

Build up with small challenges. Not sure how old your daughter is, but, for example, our 7 year got a gift card. They wanted to know how much it was worth -- so they were the ones who had to go up to the counter to ask the employee. Just practicing going into uncomfortable or unfamiliar situations is valuable, and leads to confidence for the bigger stuff.

My parents did this exact thing to me growing up and I hated it at the time. I now see how valuable it was and will doing the same with my kids.