True of course. But Chrome usually need you to explicitly confirm a download if it involve an EXE. Then there's the UAC. And so on.
And then again, one can also click on the wrong gadget when an AV turn up a window screaming about a possible virus ad asking what to do.
What can I say? I take my chances. Works for me. YMMV.
Not that I recommend it...