I actually think both points are valid.
Yes, scams work because people let them; be it doing basic things like checking who sent that email or questioning what is being asked of them.
But this is also why crypto has such a stigma in the public - heck, I came WITH this very stigma to Nostr (idk how that happened either). However, while I had the time to take a closer look and actually play around with the tech, most others just... dont, so the stigma of "crypto is for scammers and hackahs" stays and sticks. 
A while ago I just brought it up while people were talking about cybercrime in a café that I frequent and I was immediately met with exactly that: "Oh, the scam thing? So you have some? Wow didn't know you are a millionaire" x.x Haven't brought it up again since, but this is unfortunately - at least here in germany or rather the area I live in, to be fair - what people do indeed think.
The real success stories of people living custodial and sovereign are never broadcasted since good news don't sell, naturally - so the scams is all they know. :/