That's the thing, isn't it. Regular folks who don't really know how any of this (in the broadest sense) works will have no idea where anything that they type into the computer goes.
Quite frankly, with this sort of thing, it's absolutely the company's responsibility to ensure that their staff are being properly trained, if the company's information is that important. That means either actually investing in their employees, or ensuring that newkids are up to snuff on this sort of thing.
It's probably even worse with the people who've only ever poked a tablet or cellphone; a good number of those won't even know what a file is, let alone shit like sending network traffic to third party servers.
From my own company's "security" training, they do actually touch on this, but only with some very light detail.