Quit with the victim blaming
"This is true, of course, but malicious emails can look convincing, and inevitably not all users will follow best practice."
User tells macros not to run. Macro runs anyway because it's somehow "special". So what was this about best practice?