Quoting TFA, which is paraphrasing the source whitepaper: "Security professionals need to consider that user education costs everyone (in time), but benefits only the small percentage who are actually victimized, he wrote."
Perhaps I am dense, but can anyone explain how this statement makes any sense whatsoever? User education benefits those who are actually victimized? Someone who has been victimized as a result of his own ignorance or failure to heed security advice/user education certainly has not benefited (other than to have experienced a real-life "teaching moment"), nor has the poor sot who got victimized through sheer bad luck!
Full disclosure: I happen to think the source material is short-sighted and takes a very naive view of aggregate risk, some interesting points notwithstanding. But the quote above is just pure nonsense.