Yes. The issue is that security and privacy are tragedies of the commons. Individuals rarely have the time or skill to improve the situation, and it's almost never rational for individuals to do so — the benefit to them is probabilistic and low-probability, and the cost in hours of time is high.

But the benefit to society is great of doing better on security and privacy.

This is why governments should regulate security and privacy. The whole point of governments is to solve collective problems together.