hmmm...I agree there is no such thing as a stupid user, however how is it going to change? User often say "I dont need to know that" or "im not paid to know that" or even harder, try to take it in and cant.Its like the old saying "a person is clever but people are stupid"Security is always the weakest link.you also have some pay brackets where the user is not interested and sometimes lack the cognitive ability to get it.Calling someone or people stupid is not technical correct but often the end result is the same.
People that are trained and choose not to comply need to be punished. You may have to fire a couple of users to get the point across. It doesn't matter what pay bracket they are still punished. That will improve security for sure.