PCs have been on peoples' desks for 20 years plus.

If you've got a pillar drill, you tie your hair back before drilling the workpiece, to save you drilling your face off.

If you've got a phone, and someone rings up out of the blue and says "Hello, I just need your bank account details for a moment please to give you the cash prize moneys!", you don't give George your bank account details, because there are no cash prize moneys.

My company (OK, it's mahoosive) briefs its staff endlessly about not doing this or that on social media sites, not downloading this or that executable, not signing up for mailing doodads from work addresses, and a load of stuff which boils down to "work computer is for work (and although you may do personal stuff on it, you can't do as much personal stuff as you would on your own computer: no YouTube for YUO!)"

OK, it might be a staff education issue. But an engineering company wouldn't get away with "well, Jim drilled his face off because he didn't know to tie his hair back, and we're too small to be able to afford to do the safety stuff" and I don't see much difference between that and "well, Jim got a virus on his computer after watching a video of cats fighting on the internet, and now our domain is on every spam blocklist ever, our customer details are on the intertorrents, and no customers can get to our web site, but we're too small to be able to afford to do the security stuff".

AV software isn't a panacea, although it does keep a large amount of crap off your computer.

The rest is user education. It's part of the cost of doing business.