Relatedly, I believe the reason that Word is being used as the exploit vector on Windows is because it doesn't have the sandboxing of IE/Firefox/Chrome. While you could get a lot more people to run the Windows attack code if you posted it on websites, it doesn't do any good when every popular browser newer than IE6 is locked down to not be able to launch arbitrary programs or write to most of the filesystem or registry.
Actually from Office 2010 onwards it does have a sandboxed mode which is triggered based on the origin of the document:
Incidentally I'm not sure Firefox has a sandbox as such at least on Windows - e.g. it doesn't run as a low integrity process like IE.