You can pick up malware from a website or an advert on a website. You can pick it up by a friend bringing an infected device and attaching it to your home network. You can pick it up from a phishing link or attachment. You can run an IoT device that downloads malware and propagates it to other machines on your network. You can install a dodgy app on your phone. You can run an application that has a chain of dependencies down to some obscure backdoored library (xz). You can run software that downloads automatic updates and whose update server was compromised (Notepad++) or whose signing certificate was compromised. You can pick it up because someone else in your family did any one of these things or many others.

Malware isn’t just for people who do obviously dangerous things like downloading cracks and keygens.