You are right to a point about fuckwit users, but the MS move of hiding the file extension was a good trick for fooling partially sensible users by sending nicephoto.jpg.exe so they see in the file manager a JPEG photo, and the exe bit is lost.
Now you can harden both Linux and Windows against the click-and-run thing, for example by making all user-writeable areas non-execute (you do put /home in a separate partition, don't you?). But as you say, a user willing to provide name & password to a suspect link is just a big problem.
2FA is a big step forward, and Fartbook do support that, but when I had an account with them I was absolutely not going to give the data-slurping bastards by phone number as well. My bank uses 2FA for some things, or a card reader in other cases, so for major stuff it exists now. But having a universal fob that you can use when signing up for ANY service would be nice, so you don't end up with a whole pile of crap to take with you anywhere you want to be secure and don't trust your phone (it is both internet connected, and probably unpatched, where as a random number fob has only I guess a public/private key pair that one half of needs securing and it need not be on the Internet).