Ransomware infections frequently start with a phished user, not a popped web app.

Not to mention since a few weeks ago several other CVEs have dropped that would have been just as exploitable. Such as *sshole