This is not a naive statement by me caused by assumptions. I actually did exactly this with a patched modern browser and good antivirus and my system became infected in the process.

Mind you I indiscriminately clicked on known "bad" advertisements in the process of doing this. Don't believe me? Try it for yourself. It is actually very easy to get malware if you click around foolishly.

Also, I have written multiple web crawlers, and have collected a large variety of JS based malware that can and does break modern browser security just in the process of fetching domain homepages. ( JS code embedded directly in index.html on domains )