Instead of telling non tech savvy people (and my CS professors) to keep JS disabled in their browsers, "security experts" tell them not to open unknown links. So nowadays, these people refuse to open links that are not youtube, facebook, instagram.