If only users actually changed their buying behavior on the basis of security or privacy. Until that happens "users don't care about security or privacy" will continue to be the default since economically speaking it is absolutely true.
What users care about as revealed by buying behavior is: user experience, user experience, user experience, user experience, cost, user experience, and user experience.
What users care about as revealed by buying behavior is: user experience, user experience, user experience, user experience, cost, user experience, and user experience.