Honestly, before recommending security practices that go beyond their head I would recommend trustworthy open source as an alternative. There, the only concern is upgrading, like with any software. I wouldn’t trust most people with being skeptical and thorough enough that it would meet my security baseline/requirements. So I would always make sure they understand risks and consequence risks before sharing concerns and practices - which may very well serve as “that’s too much to consider, I feel unsafe now too” for them.