When the secure path is the hard path, people route around it, and you can't train your way out of bad design. Investing in tooling that makes the secure choice the easy choice solves at the source what awareness campaigns only patch.
“If security is hard to do, it won't get done.”