Strongly disagree. The linux desktop has something like 1% of the marketshare and is far from the lowest hanging fruit. And basic, sane security defaults are plenty good for simple web browsing and emailing.
My grandma used to get calls 2-3 times a month from "Microsoft" and "Comcast" trying to get her to download team viewer and cough up some passwords to Windows 8. She eventually got phished by downloading something dumb via email. I put her on the Ubuntus, with some tweaks, and she's doing fine. 10/10 would do it again.
> For example, the package manager is very nice, but when you want to install anything that is not in the official repos, your options get just as bad as windows, or worse
Grandma ain't installing Steam or an obscure 3rd party metasploit framework -- standard Ubanto repos are fine. She doesn't need rpmfusion to access Office365 emails.
> On Windows, you at least have some anti-virus tool scanning for known malware
Clam-AV is a thing in Linux and works fine -- we used it on mail relays a while back and had decent results. If you're putting trust in the default MS virus protection you're naive.
Also, from what I've seen, custom updaters are still the most common way of delivering updates for Linux outside the distribution-maintained official repo, as most people ship software for many distributions, and maintaining one repo per distribution quickly gets annoying. Ironically, this wouldn't be a problem on Windows or MacOS, if they decided to include a package manager with support for custom repos (the app stores allow side-loading, but do not allow custom upstream, as far as I know).
Also, some of the most common practices on Linux that are claimed to be superior from a security standpoint are just bad. For example, the package manager is very nice, but when you want to install anything that is not in the official repos, your options get just as bad as windows, or worse, despite what many people think. A common recommendation in advanced projects is to add their apt/yum repo to your system, which is not only equivalent to downloading stuff off the internet, it is also you registering them as trusted to deliver updates to your system forever. On Windows, you at least have some anti-virus tool scanning for known malware, so you still have a small chance that you won't be allowed to run some well known malware from years ago.