Oh, to my knowledge web servers (and mail servers, etc.) get attacked all the time. So do routers, IoT devices and so forth. But those attacks work differently

Oh, to my knowledge web servers (and mail servers, etc.) get attacked all the time. So do routers, IoT devices and so forth. But those attacks work differently from a user innocently clicking a link they received via email or opening an attachment. And your desktop machine typically doesn't have any services exposed to the Internet. I think Android malware is a thing, but I don't know enough about this to be less vague.