No idea about the vibe-coding platforms, but systems like Claude Code have explicit allowlists for commands. Don't allow it, and it'll ask permission each time.
I mean, can't it be both? Individuals have personal agency and are responsible for their own actions. Individuals also respond to incentives which, in aggregate, alter the observed distribution of those individual decisions. The problem can be addressed at both levels.
A widespread and, I think, unfortunate response to "Facebook Login" was for people to say "oh, sure, these people didn't realize they weren't on facebook.com, but that's because they were too busy curing malaria and designing maglev trains to concentrate on anything so petty."
Fact is, we have to design for smart non-technical people AND dumb non-technical people.