I agree.

In general, internet security is multi-dimensional, in that it includes at least three layers:

• the security and integrity of the technology or platform one is using,
• the reliability and ethics of the platform vendor (i.e. their platform may be rock solid & secure from a purely technological point of view, but they may or may not be deploying the platform in a manner that respects the security of the user's data), and
• the user's own online practices, be it in how they manage passwords, the extent to which they assume that nothing is private, their choices of operating system and applications, as well as the amount of research they do before trusting any platform with their data.

Out of the three, only the third is 100% in the user's control.