It depends what we mean by "personal risk model".
I don't think that what people do is look at the pros and cons of masking, say, using the available information, and on that basis they then decide whether masking makes sense.
Instead, they decide whether they want to worry about a potentially serious threat to their health, and they decide that they are more comfortable if they ignore it. Denial of a threat rather than acceptance of a given risk level.