One way would be to let them find out the hard way. Make sure they understand that everyone can see what they do and say and that they can find them back as a first base step. Let them have to click the right download button when downloading a mod for their game, you know. Make a setup so that if there’s theres a big oopsie with their devices yours arent affected. And from there they will install an ad blocker or learn to find the download button. You could also make a fake blackmail or phishing email to see how they react (I’ve thought about making a fake phishing email for the elder ones in my family recently too…) and make it so that if they click, the screen goes black and red with crazy sounds.
That’s how I learned too, but at first yeah obv training wheels are useful in order to not have to reinstall the os every 2 days. About malware though, it may be more sneaky in general but some sites I’ve seen recently still use the old ways, especially for game mods or file downloads, they still use the giant green download button trick. Also, she will grow up in the internet that we have today, so if she learns the old stuff, it may not be that useful
In any case, just for thinking of this, she will probably be one of the most tech savvy person in her generation! I hope she will be thankful