In practice this doesn't affect the overwhelming majority of people as they're either not going to be compromised (the most likely case) or, in the tiny chance they're compromised, they're not going to notice (in which case from their perspective it still "isn't broken").

It isn't like this is the original WinXP during the era where computers connected directly to the open internet and caught viruses just by existing, making computers groan and being very visible that something was wrong. Pretty much everyone is connected via a firewall and on top of that Windows has improved its security considerably over the years. And there are still security updates for browsers (the main vector for malware by far) that support Win8.x (e.g. Firefox ESR will be supporting Win8.x until next year and people have made Win7 and Win8 compatible builds for modern Chromium).

So it isn't surprising that for all intents and purposes it isn't broken, especially when the alternative is having to change to something that feels like downgrade in terms of UX. From a user's perspective it is a choice between the unlikely potential of something invisible perhaps happening (getting compromised) versus the absolute certainty of something very visible happening (having to get used to a worse UX). Considering Windows still tie security updates with everything else, it isn't surprising that people judge based on what they perceive the most.

Of course the best solution would be to switch to an OS where such choices are not necessary in the first place. I've been using Window Maker since early 2000s and the UI has remained the same since 1997 when WM was first made, aside from the occasional theme change (which is done only whenever i personally feel like it, i.e. is not forced on me) while at the same time i'm using the latest Linux kernel, C library, drivers, etc with all security fixes. I do not have any choice between having security fixes or using a GUI that i am comfortable with - i get to have both.

It is VERY much a "compromised but don't know it, or it doesn't slow down things or break enough for them to notice" territory.

The state of security is /awful/ for general users.

But they also can't figure out how somebody keeps getting into their email account, why they get text messages that quickly disappear from history, or what these weird charges that keep showing up on their bank statement are...