So I'll take that as yes, you insist that people must accept additional risks to red your pages. You place ease of development (or maybe unnecessary-but-shiny features) over the safety of users.

> 1%

That just proves my point about how widespread this disregard for safety is in this industry. Saying "but those people make broken products as well!" isn't a justification to do so yourself.

> driving

is off topic, and in no way comparable. I am not being forced to accept risk from driving to read document or submit a simple form.

> Java and Flash

Not documents. More importantly, this is another example where saying "but he did it to!" isn't a justification.

> missile launch codes

This is just cheap hyperbole intended to distract.

> don't browse [unless you let us force risk on you]

At least you admit that you agree with this ultimatum.

> my browser IS vulnerable

Yes, it probably is - so maybe you should start to work on fixing that situation. A good place to start would be limiting the use of the main vectors for infection... which is javascript. The paper even discusses (and I quoted) how the use of javascript enables auto-selection of attacks.

> my CC details and DOX aren't worth

Ahh, the "but I'm not interesting enough to be a target" fallacy, where you only consider targeted attacks.