The threat doesn't come in the form of phishing or malicious sites.

Legitimate business sites are rooted. Everything from ebay to facebook accounts are taken over through password redundancy through those sites. Botnets are out of the equation too. Just pick popular sites and use javascript to refresh multiple hidden iframes to ddos.

Either the kids are doing it wrong these days, public perception, or both.