Pushing directly to main just feels better.

Sadly this will probably not change unless attacks become so frequent that paying the ransom is more expensive than hiring competent people and teaching them proper opsec.

It’s bound to happen at some point, but I wouldn’t hold my breath.

I think “user” in this case means “employee”. Phishing is by far the most common point of entry.