What's the most overrated mobile security feature that gives users false confidence?

App permissions, biometric locks, "secure enclaves," VPN apps—there are features everywhere promising protection. Which one do you think creates the biggest gap between perceived security and actual risk reduction? I'm interested in what you warn non-technical friends/family about when they think they're protected but really aren't.