Because grandma clicks on the embedded file when she thinks it's from somebody she knows.

That tells us how the exploit works, now why this person thinks it's the biggest attack vector.

Most internet users are very stupid when it comes to tech.

I know, but I'd like to see the numbers. Do people in 2016 have the same email habits as in 1996? I don't know, but everywhere I look, people are running safer email clients, usually in the form of well-sandboxed applications that hide most of the sharp edges from the users. I'm willing to bet email is a smaller vector today than 20 years ago.

I would be willing to bet that the difference in numbers between people using email and people running JS is enormous.