At my previous gig I observed a few worrying things that were not fixed with security training:

- People still stored passwords on Slack channels, emails, Confluence, etc.

- People still used simple passwords such as "password".

- Literally nobody who wasn't already using a password manager started to use one.

In my opinion SSO, 2FA, etc. are absolutely needed at many places where people can't be trusted with following basic advice and training.