&quot;My intuition was that malware attacks were less prominent nowadays.&quot;<p>They are and they aren&#x27;t. What you&#x27;re seeing is a combination of economics and improvements in software quality. Economics says they focus on whatever gets them the most zombified PC&#x27;s since competition drives prices of each individual PC down in black market. To get this, they target apps with most widespread use. This is why almost all 0-days were found in Windows, IE, Firefox, Java, Adobe Acrobat, etc.<p>Microsoft&#x27;s SDL &amp; QA tools did them a 180 on code quality. Low-hanging fruit in major apps might be drying up because so many bugs were found. Attackers shifted focus to backend databases via hits on web apps as that&#x27;s new low-hanging fruit (read: shit security) with huge rewards (eg million records at once) for success. So, it&#x27;s not that it&#x27;s gone away so much as not as popular while low-hanging fruit exists for their purposes. Organized crime, esp targeting online banking, plus nation-states continue to find, sell, and use 0-days for malware. It&#x27;s still a thing except stealthier and more targeted.<p>&quot;Aren&#x27;t these more easily exploitable in practice than say a stack overflow somewhere in my programs (not a rhetoric question)?&quot;<p>Oh yeah. Skilled hackers look for all of that. They&#x27;ll look for that kind of stuff first since it saves time.<p>&quot;The morale is an ignorant user can easily be exploited even on OpenBSD&quot;<p>No argument from me there.<p>&quot;while a security-savvy user can secure himself even on an insecure OS&quot;<p>That&#x27;s been disproven by too many pentests. You can cover lots of known risks but then get hit by something inherent in poor foundation you built on. I liken it to building your castle on foundation of quicksand. Security properties work layer by layer, piece by piece, from bottom up plus interactions with other systems via protocols. I <i>might</i> be able to secure DOS apps but DOS&#x27;s intrinsic properties might eventually do me in. See what I&#x27;m talking about?