Mostly yes, but there are some closed source services which are still good options for this specific threat model.

And I just thought the clear explanation of the why combined with the list, makes this an excellent blog to send to people who don’t get it yet.

The list itself is something most of the people in this community know already, but you might want to send this when someone asks “why?”