When Does Targeting Make Sense for an Attacker?

How do so many Internet users escape harm? The range of attacks is enormous and growing; we know that most users neglect even basic defense measures. Yet things somehow muddle along: 2 billion people use the Internet and seem to derive more good than harm from it. If security is only as good as the weakest link, why don't worst-case outcomes happen regularly? Why isn't everyone hacked every day? The answer might lie in economics rather than technology.