A bit of side track, but the 2014 massive hack was due to bad passwords hygine AND a serios vulnerability in Apple icloud (backup restore would bypass f2a and login failure rate limiting).
Back to the subject. See the reports from citizen labs, Google TAG and others. You will see they are often due to undisclosed vulnerabilities not user stupidity
A bit of side track, but the 2014 massive hack was due to bad passwords hygine AND a serios vulnerability in Apple icloud (backup restore would bypass f2a and login failure rate limiting).
Back to the subject. See the reports from citizen labs, Google TAG and others. You will see they are often due to undisclosed vulnerabilities not user stupidity