Simple answer. That's no longer true, malware attacks are now most common. However that doesn't mean they are most important to everyone.
Various bodies like SANS/CERT and so on publish statistics of incidents they handle (for example UK Cert Q3 2015 report). Key quote:
malware is, and remains, the greatest threat to cybersecurity.
And that seems to be clear across almost all domains and reports. After that Phishing is almost universally listed second. This doesn't match with the (old) conventional wisdom that most attacks are social because most malware attacks are now automated. Instead of targeting one chosen machine, they are part of an massive automated attack looking for victims that match a given vulnerability.
By definition, however the statistics only cover the "unsuccessful" cases where the hackers get caught or don't even try to hide. For example there is a lack of reported cases where hardware was compromised during delivery. That's probably because people only just started looking. Apple seems to be a target for this and started checking all circuit boards. Soon we might find out that it's an important case. Or maybe they won't choose or be able to tell us:
Many of the organizations were compromised and, therefore, out of
compliance for months, and some for the duration of the study—meaning
they never detected their compromises or outbound malicious
communications, nor did they acknowledge warnings from the Norse
- quote from SANS health care report - nobody will ever investigate these cases
However the whole statistical approach is misleading. It's "think like an engineer" instead of "think like an attacker". The majority of malware is randomly attacking everyone and don't particularly care who they get. For them the weakest link is the computer with the worst security. Probably, because they are working in big companies who actually hire security people, most security people should be more worried about a targeted attacker such as an employee or overseas competitor who will be more likely to use a social attack simply because the cost of entry is lower than writing custom malware. Even if an attacker is using malware for compromise, they may need to get it past your firewall. They compromise one machine via a phishing mail and then 1000 more inside your company with a worm. Does that count as one phishing attack and 1000 malware attacks? In the statistics it does.