Exactly, many, if not most, people, actually make an effort to think about what "personal" information is actually being given and make an informed decision about the risk versus benefit analysis. Others just make, quite frankly, barmy decisions based on not understanding what information is actually available and how little the recipient can do with it.
It's like people who refuse to give their bank details to someone, yet happy to hand them a cheque (on which are printed all their bank details).
Like my mother who won't recycle envelopes etc with her name and address on because she read in the Daily Mail once about people rifling through bins to find paperwork with personal information. She can't be arsed to engage her brain to realise that what criminals want are valuable "data" like dates of birth, passwords, security codes, bank statements, payslips, HMRC/DWP letters, etc - things that give them information not readily in the public domain. But the fact that literally anyone can find her name from voting records or her phone number from directory enquiries (neither of which she opts out of despite me telling her she should), so it's not "confidential" information anyway, yet come Christmas, she'll be there shredding all her christmas card envelopes!
It's why we don't have identity cards, despite them being, on balance, more beneficial than detrimental, because people couldn't be bothered to actually research the type of data that would actually be contained within the card itself (minimal).
Personally, given the "techy" World in which we live, topics around data security, data privacy, etc should be taught in schools, in the hope that the next generation have a more informed and balanced view about personal data, what to protect, what really doesn't matter, etc. We seem to be very polarised at the moment with, at one extreme, people not being remotely careful about what personal data they share and the other extreme, people being too paranoid and not sharing even harmless data when it would benefit them.