Because most people can't even set the timer on their VCR.
I agree firewalls help, but they are not foolproof. If the user runs an emailed executable, it could still take residence and mask its communication as being from a browser that the firewall will have already been set up to allow penetration.