My anecdata is that the majority of times someone has gained access to a user's system somewhere that it has not been anything technical but purely social engineering. Whether that was a secretary at a medium-sized company or someone in medical records at a hospital. The latter case was more extreme - user received an email from the hospital's lawyer, replied saying she wasn't sure, "lawyer" emailed back to go ahead and access the website. Lawyer was the 'hacker' who had already broken into and taken over the lawyer's email. Luckily, it was phishing attack and not ransomware.