Don't use Windows

It isn't nearly that simple any more and hasn't been for quite a time.

The Windows security model is not the broken mess it once was when properly used so the key problem is user behaviour particularly home users running as full admin, installing random crap without thinking about it (or simply not knowing any better), just clicking through any warnings they do get, and so forth.

If enough of that sort of user migrates over to Linux and kicks it into working the way they want (i.e. the bad way they used to work under Windows) you'll no doubt see the number of effective exploits balloon massively.

Jeff Wayne's Martians were right: "The problem is, of course, the humans."

With alternatives like iOS, I feel it's simpler than ever to switch away from Windows. I'm not advocating using their closed ecosystem, but it may have some advantage. Especially for those grandparents etc.

That only works until enough people use an alternative. Then it will be interesting to start searching for bugs and security holes in the alternative. Just look at all the webserver exploits lately. Nothing is bugfree.

Still works now though so it holds true. However for instance Android is used far more than Windows and iOS is getting close and those are still not close the misery Windows is in this regard.

We don't really have a reliable measure of how many attacks are happening on Android and iOS, though. Unlike with a PC, users are much more likely to attribute malware-related problems to 'my phone is just old, I need a new one'. I would attribute this to a mixture of phone commodification (iPhone's appear to be pretty cheap thanks to subsidy plans) and the effects of cloud infrastructure. Users have basically nothing to lose by swapping out phone hardware, because what'll you do, ransom their contact list?