I still think you're giving bad advice, kite even though I realise there is some sense to what you are saying. It's not just some 'dark web' or other unsavoury website that doles out malware etc. I've had spoofed "alerts" from my bank, complete with surprisingly convincing return email addresses and all that.It's the naive ones that are victims by lurking where they shouldn't.
Normally, people don't fall for them. It's often someone is vulnerable in some way -- tired or in a hurry, or with some other thing attracting attention; someone who's been paying a lot of bills online and then gets an "invoice" who get snagged.
I even have anti-virus on my Mac, though there aren't too many events as bad as Wannacry or something like that with Macs.
And I use a VPN most of the time.