Exactly, because they're high value targets, as I mentioned. But they're going to use more exotic exploits than an attack on linux desktops, because the expected return vs work to get the exploit makes more sense. Grandma isn't likely using linux to access her bank account, but she is likely accessing a linux server.