I chose that title, but there are probably several ways to ask this question. It's all about understanding how a computer (especially desktop, but you could generalize this to servers I guess) can get infected if it's always up to date (daily updates) and if you are not stupid enough to explicitly allow execution of untrusted software. For example, everybody says you should not open suspicious attachments in emails, but why not? If there is code or macros in the attachments, the application should warn you and ask if you want to execute it (at least that should be what LibreOffice does). If you connect a USB key to your computer, no software in that key should be executed automatically (that's what Linux does, and I hope Windows today asks you for confirmation anyway). Same thing for "drive-by downloads", if you don't accept to download a file, install a plugin, etc. then how can anything happen just by browsing a website?
Unless attachments, USB keys, websites, etc. exploit a 0-day vulnerability. Then yes, everything can happen without your consent, and everything is possible in theory. But how common is this? So, going back to the question in the title: what percentage of infections are due to 0-day vulnerabilities? My impression, which might be wrong of course, is that it's a very small percentage, almost zero, and that all the infections are due to people not updating their software regularly, people clicking "ok" to give permission to execute something that should have no reason to be executed (like document.doc.exe, do you want to execute the following program? Of course! Click), people accepting to download updates for whatever software or plugin from unofficial websites, and so on.
So I'm asking about 0-days because that seems to me the only class of vulnerabilities that makes sense considering. If you don't update your software you can't say "I got infected just by browsing a website", but you should rather say "I got infected just by forgetting to update my browser/OS/etc". My reasoning basically made me come up with 3 classes of vulnerabilities (out-of-date software, explicit consent to run untrusted software, and 0-day vulnerabilities) and since the first two classes can be easily neutralized I'm just focusing on the likelihood of the third. Unless of course all my reasoning is wrong.