This is basically it. Yes, there are a million ways around the best protection (even on mobile!) but it's all about user trust and setting norms.