Indeed, they are not heavy excel users. Which is sort of the point: the need for targeted attacks greatly reduces and segments the addressable “market” for the bad guys.