I dont know. I’m in an adjacent industry, and even amongst some of my colleagues who do have degrees, there are some significant knowledge gaps. Companies often have entire teams dedicated to cyber security, and still get this wrong.

There are just so many subtleties that need to be done right. I’m pretty certain that even my setup isnt properly secure, and the only reason things haven’t crashed down is pure luck.

The appliance model is probably the best way to enforce security practices for regular users, but that pushes significant control/responsibility back to the supplier (they must stay up to date with patches, force push out updates so no one is left behind, limit flexibility so everyones setup is relatively homogeneous). Done right (for security), that costs a lot of money, so likely a subscription model. And it rapidly becomes a “cloud” service that runs off your own electricity, which loses all the self hosting benefits.