The weak link is the user.
Do stupid thing behind the firewall and the firewall can’t protect you.
Yup. The vast majority of these breaches are initiated from clueless users.
There is really not going to be much you can do about this stuff as long as you have users with the ability to run arbitrary code.