But there are significantly more devices out there these days, that we don't traditionally think of as "computers". Cable boxes/DVRs, webcams, vacuum cleaners, mobile phones, routers, hell a directory traversal bug was found in a dishwasher.

Many of these devices aren't patched after they're sold, and can be compromised within minutes of being assigned a publicly routable IP - this is what happened with Mirai.

Security is better for desktop computers, but if you include everything with an operating system, it's much, much worse.