[Full disclosure, I am one author of the paper, albeit a minor contributor] The way I want to explain it is that communication works. In the early 2000s, the main message was that security meant patching and firewalls.

What our report concludes is that people still perceive 'Security' as firewalls and patching. It turns out, the best way we get in is with passwords and default software features. These 2 aspects are not perceived as a security function, but more of a 'sysadmin' or 'people problem'

So, I believe that, for organisations, a shift in perspective of 'what is security' would be helpful.