Blocking and filtering email attachments is pretty easy. There's plenty of email gateways that remove attachments from unknown/unsafe senders and replace it with hoops a user has to jump through to get the attachment. This is enough to discourage users from opening most malware.

For websites, malware hosts can be easily blocked at the gateway level. This won't protect you if someone manages to host malware on a common site like yahoo.com but will catch the vast majority.

These days it's pretty easy to circumvent or disable Antivirus or obfuscate your malware form it. If malware manages to get itself onto a user's machine then you've already lost.

Some systems will scan the email content and try to guess the password; if they can't, they'll block the attachment.