The base problem is that browsers are trying to be friendly by auto-downloading or auto-playing media files.

If neither of those happened, these exploits could not be automated (though social engineering would always be an option).

Heck, the download itself is not a problem. The problem is that the DEs, in an attempt at being "helpful" detect and parse every new file for inclusion into their search functionality. And the parsing in this instance gets done by passing the file through gstreamer, and away we go again.

This is idiocy on par with autorun!