If you give privacy/security advice without an explicit threat model, all that you're doing is using an implicit threat model that may not match the needs of the person you're trying to help.