Agreed.

Though this article is about the systems in a managed environment, which I think is a reasonable thing. The "user" here would be the org that owns those systems, and has a need to ensure they're secure.