OSNews

What is it with this myth that malware only comes from dodgy websites, warez and user stupidity?

There are plenty of drive-by exploits which don't require user interaction, or don't require users to do anything they don't normally do.
Legit websites get hacked to spread malware...
Malware can come via physical media rather than the network.
Malware can easily come from people you know and/or trust who have been infected.
Store bought media and other devices have been known to arrive already infected.
There is plenty of malware masquerading as legitimate software, and since windows didn't provide a central repository until recently and most software doesn't use it anyway, users are forced to search for it themselves and will often fall victim to malicious versions.

AV is obviously deeply flawed, but then so is the underlying system and AV acts to reduce the impact of those flaws at the expense of performance. The most effective way for users, especially non technical ones to avoid this overhead is to use a system like iOS which is tightly controlled by a (hopefully competent) external party.