. . and today it isn't just seedier sites, since legit sites are often invaded. It can be days before the (generally undertrained) sysadmin knows he has a problem.
Some of the worst infections I've dealt with were on computers "protected" by an up-to-date Norton antivirus. The more popular the package the better the bad guys are at penetrating it.