> how many of them came in the form of a dmg that the user opened and installed?

Erm, in recent years, all of them? I can't think of any exploits in the wild that have been anything other than a trojan.