Protecting the OS does protect you: stealing my data/cookies today is different than installing OS level backdoor / keylogger and stealing my bank password, tax prep, etc next month/year/etc.
You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.