So locked up platform where vendor owns your ass and fucks it the way they want to, à la Chrome.

So i assume you dont use an android device, github, etc? Everything is vulnerable to social engineering.