Not sure if this was rhetorical, but if not...
They believe they're being protected from "attacks" because that's what the people selling the service tell them. They tyoically don't ask what attacks, but if they do they get super generic answers like "hacking", "DDoS" and the like. Since they haven't "been hacked" it seems like their vendors are being honest and accurate.
The thing they often don't realize is that these services don't block attacks, they block everyone using privacy software, good or bad.
They also don't realize how many sales they are losing. There's no metric for that, and most people will never report it because they've done so before and they were told to just use a different browser.
They also don't kniw how easy it is to bypass this "protection" they are buying. For example, today, it was literally clicking one button ("New identity"). If they realized this, they would instantly understand that an attacker will take the time to click that button, but a customer may not.
