You have to understand that UAC is not there to protect you. It is there so that Microsoft can deny any responsibility if something goes wrong. You can turn it off; if you then catch a virus, it is of course your fault. Or you can click "Yes" automatically whatever it asks, so if you let some virus through, that is again your fault. And you have to click so often, if you catch a virus, you could never prove that you didn't allow it to get in.
Yeah, the most insidious flaw in the implementation of UAC is how often it prompts you to click through a dialog. Over and over again it prompt, prompts, and prompts whether or not there is any actual threat. It prompts and prompts in all kinds of situations, slowly training even the most vigilant, careful user to click through them automatically.
Eventually, when one of the UAC dialogs pops up, the signals from your visual cortex don't even need to reach your brain; they just trigger a muscle-memory response in your hand to click through the dialog.
When a situation arises that actually does require caution (hmmm, now why
would "colleague" be sending me a .zip file?), you won't even pause to think about it.
It's the OS that cried "wolf," "wolf," "wolf," "wolf," "wolf," "wolf," "wolf," "wolf," "wolf," "wolf," ... "wolf," "wolf!"