[PeterisP]

Pretty much everyone has machines that can be hijacked by drive-by malware - there have been cases where 0-day exploits have been used for such attacks through targeted ads on reputable websites.

Following other best practices doesn't help you to protect against that, but preventing third parties from injecting arbitrary content on the [reputable/largescale/https] websites you're viewing does close one attack channel. One out of many, but a valuable one.