> Presumably most people are behind a router which would stop this in its tracks?

Trouble is there are millions of IoT devices with terrible security some of which are alway owned and inside the network. They could be used as a delivery tool to attack multiple machines inside of a network.

I'm not sure how many folks connect directly to the internet anymore. Hopefully not many.