Regarding (B): A few years ago Mozilla did some user research that showed that a significant percentage of people do perceive the passive[1] negative security indicators as indicating a problem with Firefox instead of the web page. Thus, such a change does have to be done carefully. But, I think it is worth trying to find a way to do it that users can understand.

[1] Passive indicators are things like the red/broken lock icon. Active indicators the the things that stop the page load, like the "Stop! This is probably a phishing page!" error page. IIRC, users overwhelmingly appreciated the active indicators but tend to misunderstand the passive ones.

That B strategy might have worked a few years back for grandmas that got Firefox installed by their geeky grandson, but Firefox is popular now. And people (geek or no geek) don't like being told the stuff they use is not good.

Here's an experiment you can do at home: Try telling an emacs user Vim is better.