memes

Story time. I used to work for an IT service for businesses. We also offered such basic security trainings (how to not get fished by mails, keeping workstations up to date, do not insert USB drives some stranger handed you, that stuff). We had one customer, big company, several branches all over the country, even some abroad. They booked our training once a year for each branch office in our local region, six offices and a couple dozen office workers attending each time.
We had to automate reboots. First, you get an information there's a necessary update pending that needed a reboot. You could push that reboot a week down, then it got enforced. We had several tickets each month about that. We also had to restore systems twice in the two and a half years I worked there from backups due to ransomware, and other, mostly minor security incidents about once a month.

firstly, you're assuming everyone works in an office.

then, that those lessons stick.

then, that malware only affects those who essentially opt into it.

All of these are beyond-stupid assumptions.

PS. not one security training I've had did more than just mention in passing updating your device, if even that. Because guess what, IT departments don't give a choice. They manage that and force-install updates.

Your other weak-ass assumption is that work lessons (if even applied at work) also come home.

Yeah dude, you're just wrong in your thinking. Top to bottom.