[melange]

Teaching users to create separate accounts might be better, but so would any number of impractical suggestions.

It is perfectly reasonable to expect an application to provide more security than the user account provides because in the real world, we know that people don't always lock their computers. Not all applications are risky, but one that centralizes a users credentials is clearly so.

Pretending otherwise is simply not acknowledging the real world.