This is an interesting data point, and I agree that it's hard to explain. Why doesn't a newly-discovered 0-day in Windows lead to pretty much every internet-co

This is an interesting data point, and I agree that it's hard to explain. Why doesn't a newly-discovered 0-day in Windows lead to pretty much every internet-connected Windows PC being infected? (That said, there are issues around actually reaching these machines, because a lot of them don't have routable IPs and may not load your attack web page. Similar issues may arise for cars, which sure would be nice as a mitigation.) Even so, 0.5% of 1 million is about 5000 people. Not quite WMD territory, but also way out of typical "car bomb" territory... Maybe the mitigating factors would mean the actual fraction would be even less. But it would be nice if we didn't have to hope so.