Simulating a highly targeted attack is expensive, and the protection most people have against those is that they're not interesting enough to spend so much effo

Simulating a highly targeted attack is expensive, and the protection most people have against those is that they're not interesting enough to spend so much effort on. For the average person, the main threats are various forms of social engineering, mostly the kind that is really obvious to anyone who has a rough idea how security works ("This is a secure document, please click yes when it asks you to allow this document to execute arbitrary code"), and software so far out of date that common exploit kits have pre-packaged exploits.