Granted, only a standalone computer with no network connection of any kind
is fully secure from internet infections.

However, I have always assumed, subject to correction, that any malware
attempting to install itself via a script, would raise a dialogue asking for
the user's password. Unless the operator is so careless or naive as to type
it in when there is no reason to do so, most infections would not succeed in
(K) ubuntu.

But as I used to tell my students, (pulling a figure out of thin air,) "56%
of all computer failures are caused by operator error"!