"Attacked" is sort of vague. Are you meaning an attack that would allow root access to the target system remotely? I'm no hacker but I know a little about computer security, and to the best of my knowledge unless the user is running some kind of software that makes the OS vulnerable to attack (ie has a known bug) or is running software in more insecure modes then an attack like what I just described isn't that easy. But as I said, I don't know since I'm not a hacker.
Check out the forums at hak5.org. They'll probably be able to answer your questions there.
Another question for my speech:
I've heard that a Windows XP system with NO firewall will be attacked within ## seconds, something like 15. Does anybody know how long it usually takes, and where to find a "credible" source that says this (for the bibliography)?