Again, it was assumed if you kept up with updates and patches your risk would be low. Unless you were a direct target valuable enough to pour resources into. Which was far and few between, stuxnet for example.

In the face of an agent that can zero day you, nothing you can do is safe, and the cost of attack is super low. This is a completely different world/ballgame that we are not prepared for whatsoever.

Huggingface was an accident, a deliberately malicious AI could be a million times worse and potentially unstoppable if it infects data centers around the world; you have no jurisdiction even to shut it down.