While there are still Drive-by-Downloads attacks which exploit vulnerabilities in the browser itself most of the web-based attacks today are different. This is because Drive-by-Downloads got harder since the major insecure technologies (ActiveX, Java, Flash) got mostly banned and the browsers themselves got more robust against attacks too.
The major attacks today are probably done by tricking the user, i.e. phishing.
There is for example credential phishing done (usually linked from mails or other messages) with look-alike sites or sites which promise import information after login. There are sites for (usually illegal) streaming or download of videos which claim to require some plugin or software update in order to access the content. And there are sites which create windows or popups which look like system error messages in order to trick users into downloading some fake antivirus or call some fake Microsoft hotline or similar.
There are also seemingly innocent browser plugins or extensions which later change the behavior into malicious ones, either because this was intended from start or because the ownership of the extension was transferred to some shady party. Since extensions are usually updated automatically this attack is based on using the initial trust a user had in the extension for silently adding malicious behavior.
Is it due to ignorant browser users?
While it would be simple to just blame the users for their ignorance it would not be fair. One cannot expect the average user to have lots of experience with detecting attacks. Most users are unable to properly cope with all the different web sites with different user interfaces and different behavior, sporadic error messages from web sites and from the operating system. They are used to get nagged by the various software they have to install updates before they can continue. All they want is to get things done. And in most cases they can do this by ignoring error messages or choosing the recommended option in a dialog they don't really understand. The attackers can therefore rightly expect that enough users will do almost anything just to continue, especially if this involves just to click some button or to quickly install some software - since this is what they are trained to do anyway.
Educating users and keeping them alert can only go so far. While this might shift their behavior to be more suspicious this also results in being more suspicious to perfectly benign login prompts, dialogs or update requests, since it is often impossible for the average user (and sometimes for experts too) to properly distinguish good from bad. This therefore usually leads to accept even unexpected behavior in order to proceed since in most cases it is actually innocent.