It doesn’t only infect popular sites. In fact, most malware attacks are automated, which means you’re as much of a target as anyone. And if you do get infected, it can do more than disrupt your site – it can ruin your reputation.
Securing your site is just like locking your doors at night. You don’t do it because you expect something bad to happen – you do it because if something did happen, it would be devastating.