e.g. by opening malicious attachments in e-mails

And how pray tell do those malicious emails take over a system if an insecure OS isn’t at fault too?