There are plenty of security camera videos of how the attacks we’re talking about actually take place on the Internet. I’m curious if you’ve got exposure to a good sample size of them? What you’re saying sounds to my ears more like the common, romanticized version of how these attacks happen that I hear from people who haven’t seen how they actually play out.
I would say these videos show that the helpful man we are imagining is unlikely to be there when needed.
Of course none of this means anyone actually /needs/ to prepare themselves to be able to deal with such an event. This is a low probability event after all.