I do get most of my software for free, especially the MS stuff, legally even. And I don’t get viruses. The two most important steps to not getting viruses are not hanging around in the bad neighborhood on the internet (warez and porn tend to be trojan festivals) and not clicking on any random thing that comes a long (those silly smiley things and browser doo-dads almost always have bad stuff).
I often have this discussion with people. My main home computer is and has been a Windows machine for 16 years now. I have never had a virus. Hardware failures, sure, but that’s got nothing to do with the operating system. While I am in the computer field, it doesn’t take a genius to see that responsible use is really all you need to survive.
Why people don’t think this way with computers is beyond me. There are bad people everywhere. It doesn’t matter where you go or what you do, risks exist. People are generally cautious when they are shopping, traveling, or what have you, so why not with computers? Anybody who says “Well, I shouldn’t have to worry about that” is only deluding themselves. Travelers shouldn’t have to worry about being scammed while on vacation, but the threat is ever-present.
There are three simple rules people can follow. Be responsible (as you said, illegal software and porn sites usually are rife with security problems), install a free (or paid, doesn’t matter) antivirus suite (better safe than sorry), and use the automatic updates. Microsoft makes every attempt to keep their machines secure. If people don’t download the updates (which should be downloaded and installed automatically) I have no sympathy for them. This would be like blaming Toyota if you wrecked your car because you never changed the brake pads.