I think it's worth pointing out that the vast majority of the public lack the basic ability to protect themselves from vulnerabilities and are apathetic to the dangers of the act of installing random apps to personal devices, even those associated with legitimate institutions and services.
As for potential solutions, obviously legislative solutions are the way to go and would take much of the pressure off of citizens.