If you have the ability to take a look at either SANS website, and see their articles, or have your system show you all the automatic attacks hitting your machine, then maybe you will understand...
Botnets are coded to hammer-away at all possible internet-addresses, trying to break-in & highjack more machines, to include in the established criminal-machine that the botnet is...
SANS said, a decade or 2 ago, that it took, on average, something like 6 or 4 minutes for a new MS-Windows machine to be owned by some attack from the internet.
I've had linux machines cracked/owned, and wiped 'em to get 'em clean.
Having no immune-system is BAD.
Linux botnets, apple operating-system botnets, they exist.
I don't think there is any operating-system that is connected to the internet that doesn't have attacks coded to crack it.
I just looked at SANS.org, and they have totally changed, so they are now .. more a moneymaking-machine wanting B2B biz?
Here, though, are some cheat-sheets they made:
https://www.sans.org/posters/?msc=main-nav
They used to tell us the top-20 most effective protections for particular threats, identifying how prevalent the threats were, etc...
No idea who does that nowadays...
Many years ago, it was discovered that Wine could run Windows viruses/worms/malware just fine, thank you very much..
"Sandboxing", it isn't.
It runs with all the privileges of the user running the app, iirc.