There is no vulnerability more avoidable than "shoulder surfing", if it actually exists. I spent a long time finding the substance of the mythical #CVE and did not find much. But the defences against it are still a billion-dollar industry so, let's go. https://cyberprotection-magazine.com/shoulder-surfing-stupid-is-as-stupid-does