Sure they do. That's what extensions are.

That’s like saying everyone is at risk of bear attacks because a few people in rural areas do get attacked. Yes, extensions exist but when was the last time someone clicked on a link in an email and installed an emacs extension? That happens daily to thousands of web users because the population is so many orders of magnitude greater.