Any links/info on people making them? I was just looking for some, and didn't find any reports of such things in a few minutes of looking. Seems like the overall field is light, partly because there isn't any large company to pay out rewards for exploits, the huge variety of distros in the installed base, and the weak ecosystem as a result of the previous two.

There probably are plenty of holes, but they might be only found by big-money efforts aimed at compromising particular computers, meaning essentially government spying.

Nope.

The major difference between your common Windows user and Linux user is that Windows users are often logged in as Administrator. So if arbitrary-code-execution happens that code owns the whole system - checkmate.

The typical Linux user is not running their Windows Manager or browser as root. The worse that can happen is stuff to your home dir(which can be very bad too). Even this article title calling this a "userland rootkit" is kinda odd, since "/etc/ld.so.preload"(and the whole /etc dir) is a root-only writable. No matter how secure your OS is, if you're tricked into running an evil program as root/admin... it's game over.

The usage-pattern for this happening on Windows is much, much higher than Linux since Windows users are already admin to start off with. Also, from my observation of Windows users over my 10+ year career, they always click "Ok" on every pop-up dialog box without even reading it. I think that UAC thing from Windows Vista enforced that behavior even more.