Data can have malware, like jpeg, png or documents. The browser is not entirely self-contained, for some things it relies on system components, like decoding vi

Data can have malware, like jpeg, png or documents. The browser is not entirely self-contained, for some things it relies on system components, like decoding video. What protects you, I think, besides your undoubtedly good practices, is herd immunity. Most every other Win user is "vaccinated" with antivirus, and so malware authors are not keen to pick on vulns that would get their thing flagged anyways. The MS policy of including Defender for everyone raised the bar, basically.