You just missed the entire point the malware writers won't bother to hack a normal joe user they aren't the NSA or CIA.Of course if you are in a IT enviroment it works differently because then you maybe the target.
Normal average users are a very big target aside from businesses. There are thousands, and thousands more of script kiddies who want to cause damage through the use of malicious software/web-based attacks for the sake of it or as an attempt to make money; their practice is on average home users. You don't have to be working for the NSA or CIA to be a target; normal home users aren't usually "picked", but just end up getting infected through general malicious spam e-mails, malicious links they find through being click-happy, use of of shady download sites... And so on.
Even the well-trained and experienced malware authors will happily target home users sometimes. Threats like Zeus, Carberp, Kronos, WannaCry, BadRabbit, Petya, NotPetya, and many others were not only aimed at businesses. The likelihood is that in scenarios like Zeus, the source code is sold to many others who will then pursue usage of it (targeting home users, businesses, or both simultaneously).
When it comes down to a malware author trying to make money, ideally they will want to aim for a business. However, the intention is not always specifically to make money.
About crypto-currency mining and other alike, there has been an outbreak of web-based miners, which is easier for an attacker to deploy and have it remain active for a long amount of time.
Phishing is quite popular as well. Not so much on the software side through fake PayPal "money givers" and similar, but web-based.
You definitely have a point in my eyes my friend! Zombie systems are those infected with a botnet, which can be a really serious problem sometimes. Botnets infections are typically used by the attacker to attack services through DDoS attacks (using up the network resources of the infected system to target a service resulting in the services' network resources being used up -> now the service is unavailable and goes down, and becomes more vulnerable to other types of attack).
There was recently security news about a new botnet found by a vendor (maybe Qihoo) which has already infected roughly over 2 million systems. You can find more information here:
The Reaper Botnet Has Already Infected a Million Networks
Massive botnet quietly harvesting 2 million vulnerable IoT devices, report says
It seems to be some sort of "successor" to the Mirai botnet, which caused a lot of stress back in 2016.