But that's assuming it's a user that somehow became infected.

Suppose you're running DNS (many do on even their home Linux boxes)
and you get the cache poisoning because bind wasn't patched. That
can happen even if noone's ever logged into the system.

If one's system is exposed to the global 'Net, almost anything can
happen. Secondary stateful firewalls are de rigeur -- I use a
SonicWall appliance and have installed 100s at client sites over the
past decade plus.

Nothing's impossible. Recall the Internet Worm I mented a few
articles back. Stuff happens.