Typical pass the blame for bad design
Yet another self serving line of PR garbage. Take the last sentence:
"90 per cent of attacks begin with someone clicking on an email... We need to protect people from their bad habits," he noted. ®"
How about you don't make products that can be totally hijacked by opening up an e-mail or viewing a web page.
Calling garbage insecure design from the get go people's bad habits is a bit self serving.
Asking people nicely to please not hack into your insecure products is about the same as asking the burglars to please not open your door and walk out with all your stuff because a good lock is too hard to make or replace.