Private keys aren't any different from any other files, so any way for an attacker to get an arbitrary file from your PC is also a way for them to get your private key - provided it wasn't encrypted. This includes, but is not limited to:
- Accidental Disclosure
- Insecure Storage
Each of these issues must be tackled in isolation, and they may not all be of equal importance. For example, I find it very unlikely that someone would break into my apartment and steal my hard drive - but it is much more likely that my laptop is being stolen when I am travelling.
One thing that is specific to private key is that a lot of even tech-literate people do not know what public-key cryptography is and thus think a private key is "like a password, but it's a file". As such, when they are supposed to upload their public key somewhere (which is a legitimate and necessary for the process to work), they sometimes upload their private key instead.
Even advanced users occasionally fall for malware, depending on the situation. For example, a few years ago, a friend sent me a message through steam, just with a link to a file. I downloaded and opened it. Big mistake. This wasn't because I am somehow stupid (although people who know me would disagree), but because a handful of factors played together: I was busy playing a game, it was late at night and that friend happened to often just send me random links to check out. So it wasn't any behavior that raised alarm bells for me.