Sadly yes. The average joe is not a target for technical exploits that use CVEs. They are, however, targets for meatsack exploits tricking them in installing crap like remote control software.