Yep.

One of the most annoying habits of computer professionals when talking about security is how we object to every idea by showing how a stupid/lazy end-user could render it useless.

It's not that users will never do that: it's that users can't get into secure habits if we paralyse ourselves into not providing reasonable tools.