Perhaps popups aren't the way to communicate this
The reason is that we're collectively rubbish at multi-tasking, leading the team to say 90 percent of people clicking ignore, dismiss, or cancel when legitimate but distracting messages appear.
I may be bad at multitasking, but that is not the relevant info here and I suggest the above statement may be an assumption and nothing to do with science beyond being perhaps made by a scientist. I personally dismiss all popups as fast as possible because that is the most efficient use of my time. Experience has shown me that the less time I spend looking at them the better for me. So, I concentrate only on hitting that X as quickly as possible.
Also, I'm probably not the only one who doesn't use a GUI for administrative tasks, which is where security warnings are particularly important.