I think they understand that quite well, that's why when security gets in the way they just find a way bypass it.

Security has to be usable, if it's not usable then (almost) no one will use it.