You can’t study everything in school. First it’s cyber security, then, it’s popcorn and cotton candy making, then it’s banking, cooking… school can only teach so much.
Life will teach you the rest.
I have colleagues that are teachers and you would think that digital skills and safe, adequate security would be a routine part of the 1st and 2nd world societies, but it is not. Most students are issued Chromebooks and they are right proper taught cybersecurity across the full spectrum of what they should do, can do, and most importantly not do for best security.
Instead, teaches struggle getting the students to keep focused and perform the work load and assignments in an adequate manner.
Many teachers comment that most students have sub-par knowledge, no Google Foo skills, and no in incination NOT to to much of anything to provide even baseline security. Instead they are uneducated and alack skills for their grade level.
The solution to that systemic problem is mandating very specific training requirements.
Maybe. Just maybe will put in the effort to learn by study and doing, and then implements what they learned for maximum security.
However, the latest and greatest of this or that is far more important than security.
This all tieds ino the various roblems have and ultimately just opt to nothing or the cheapest.
Compared to the XP days things have gotten better no doubt despite the stats you posted. There has been a noticeable pivot to enterprise in the last few years. The statistics you posted shows a high rise in mobile infections and identity theft, they are not the same as home Windows 11 fully patched infections. Do home users get infected? Yes but there has been progress.
The amount of breaches, the seriousness of breaches, and the negative consequences of said breeches have increased exponentially since the early XP days.
Given the volume of threats out there, users using weak security solutions create the vast majority of the infection/compromise landscape.