> or some 0-day owned my machine before it was patched, then I'd potentially have been copying / dd'ing / rsync'ing a rootkit for ten years.

Isn't this a huge problem? Distro-preference/upgrade patterns aside, What's latest in the detection of a root-kit in the Linux desktop of an unsuspecting home user before they realize that they've been pwned(i.e. data exfiltration, ransomware etc.)? Assuming they aren't running any real-time scanners(Even if they want, Is there any real choice apart from ClamAV?)