I think it's rather corporate targets get bigger results than individuals.

Hacking an individual is good if you need a zombie for a botnet.

Hacking a hospital and hitting them with ransomware? Hospitals got some damn money. Regular people do not.

Further, while users might be installing FOSS left-right-and-center, unlike corporations who are installing FOSS, most of what the average user installs doesn't need secure networking and access control rules behind it. Most corporations use a variety of different FOSS all together in one package, and most of them are internet and network oriented, to function at scale, and as such, they have way more easy ways to get in and have way more valuable assets.

I think, even if it had major market share, that most attacks go after big entities these days because the risk just isn't worth it with small potato people like me who are broke, comparatively.