you will never be able to eliminate your attack surface, and employees with good will can be your eyes and ears on the ground.

All the good will in the world won’t make up for ignorance. Most people know basically next to nothing about IT security, and will just randomly click shit to make the annoying box go away and/or get to where they think they want to go. And if that involves installing a random virus they’ll happily do it, and be annoyed that it requires their password.