Vast majority of malware doesn't use any exploits, let alone something like a zero-day

Most of malware, logically, abuse common features within the operating system