You can pick up malware from a website or an advert on a website. You can pick it up by a friend bringing an infected device and attaching it to your home network. You can pick it up from a phishing link or attachment. You can run an IoT device that downloads malware and propagates it to other machines on your network. You can install a dodgy app on your phone. You can run an application that has a chain of dependencies down to some obscure backdoored library (xz). You can run software that downloads automatic updates and whose update server was compromised (Notepad++) or whose signing certificate was compromised. You can be the victim of a sophisticated supply chain attack (SolarWinds was corporate but it could happen to any complex software). Those are just the first few that spring to mind. And you can pick it up because someone else in your family did any one of these things or many others.

Malware isn't just for people who do obviously dangerous things like downloading cracks and keygens. There are many vectors for it to get in.