Well, according to the BBC article on this, RBS have reported that 70% of fraud victims do NOT get their money back.
If this is true, it goes against what he's saying. Then you also have the delay in getting the refund inconveniencing the victim, the hassle of reporting it, and the fear and uncertainty they'd feel while going through the process.
Basically, people don't patch because they don't think they'll be victims. Once they are, they'll patch like crazy. AKA people are generally lazy.