The os exploit is, within this context, after the fact and therefore a non sequitur. You should look up the Project Zero watering hole analysis where they revealed something like 17 0-days being delivered to visitors of one particular site. It's likely that citizen labs only had windows exemplars.

It was a Windows exploit that ran. An adBlocker (funnily enough) would've been an excellent defense against this, given that the exploit ran in JavaScript served in targeted ads.

Though, there is a browser patch for this, don't advertise so much identifiable information that an advertiser can identify a user or their employer. That's the defense, but it'll never happen.