The truth is that most attackers are just average Joe and Josephine Blows with mischief on their minds and too much time on their hands. And, there are lots of them. Information about the vulnerabilities of all types of devices is widely available on the Internet, as are instructions and software tools for launching attacks. Now about those known vulnerabilities. Most car owners, for example, have been at one time or another sent a manufacturer's recall notice to address a quality defect.
Software products have defects, too.
Unlike cars, however, software is never recalled and fixed by the developer. Software owners are expected to discover the availability of these patches on their own and apply them themselves. This often doesn't happen because software owners aren't aware this issue exists, believe someone else is handling this for them, don't know how to find and apply patches, or just don't see the need. When software patches designed to correct security-related flaws are not applied, the device running that software remains vulnerable. People who wouldn't dream of leaving their homes unlocked, don't password-protect critical, possibly confidential, files on their computers.