"Common sense. Decent anti-virus" Doesn't wash nowadays
Seems to work fine for me, I also don't see IT departments rolling out NoScript,AdBloclk Plus,AdBlock Plus Popup Blocker,Ghostery,Better Privacy,Browser Protect,WOT/World of Trust, HTTPS Everywhere,Spybot S&D,Spyware Blaster to their hundreds or thousands of endpoints, do you ?
And anyway, if you want to install all that, you might as well just install one commercial "endpoint protection suite" type programme.... at least then you'll only have one thing to troubleshoot and one reasonably optimised thing running in the background.
Trying to troubleshoot which one of twelve plug-ins is causing your system problems must be terribly frustrating and time consuming.
Oh, well, each to their own I guess.