1) Even if the malware is successfully downloaded by the user, wouldn't he still have to execute it himself to infect his system?
I'm talking about a case where no security holes in plugins like Flash or Java are used. The user would at best have a binary file in his downloads folder, maybe without even knowing it's there. Then what?
2) In malicious emails, why would you send a .js file as attachment that'll download the malware rather than the malware itself directly ?
I've even read about JS files in zip archives. Why? Most tech-illiterate people wouldn't know how to unzip a file and then try to open the document.