Agreed, social engineering from the user's point of view is usually moderately easily preventable with vigilance, however a weak moment (e.g. not properly checking or verifying information) or insufficient education may still allow it to happen. And one way for malware to gain access in the first place is social engineering as well (e.g. e-mails with malicious attachments), so it doesn't need to be the end all way of access but can also be a part in the chain.
Agreed, social engineering from the user's point of view is usually moderately easily preventable with vigilance, however a weak moment (e.g. not properly checking or verifying information) or insufficient education may still allow it to happen. And one way for malware to gain access in the first place is social engineering as well (e.g. e-mails with malicious attachments), so it doesn't need to be the end all way of access but can also be a part in the chain.