... most viruses and spyware these days are brought in through User Choice
I would have agreed with you until last Friday, when I got hit with a variant of the
WinPup / AdClick trojans - simply by viewing a web page. No security warning, no download prompt.
The virus managed to get past both IE6 and my anti-virus software, install itself in several places, replace the Windows Media Player executable and prevent WFP from restoring it.
This was on an XP SP1 / IE6 SP1 machine, with all critical updates installed, and the IE security settings locked down extremely tight.
If I could remember which site the virus came from, I would be inclined to report this as a security problem with IE6, but after spending the day disinfecting my computer, I can't even remember what I was looking for in the first place.