Even if I agree with you that the "average person" meets the 3 specific criteria you list (which I don't), I don't believe the claim that the typical security training includes specific instruction in how TLDs and domain registration work, at least not in enough detail for a person to be able to follow the discussion we're having here.