This is a follow-up question related to Is single-click phishing possible?.
If such a convenient attack is possible, I assume everyone on the internet should already be hacked. Why hasn't that happened?
You don't describe the attacks you envision in detail but regarding classical drive-by-downloads:
In other words: there are less vulnerabilities now, they are harder to exploit than in the past and it is harder for an attacker to infect lots of users without being detected and quickly blacklisted. These things together make drive-by-download attacks much harder to do and much more costly for an attacker. The attackers therefore move to different ways to attack users: while attacks via web went down in the last years attacks via mail actually increased.
Also, even in the past where drive-by-downloads using Flash, Java or ActiveX where kind of easy, the sites spreading drive-by-downloads where quickly blacklisted by the browsers and by antivirus products or the sites were taken down. Thus these attacks were never as omnipresent as necessary to hack almost everybody.