Pre-XP versions of Windows are certainly vulnerable to targeted attacks, such as you'd see from Metasploit -- if you're the sort of high-value target that attracts such attacks, don't run Windows 98.
However, most malware isn't that flexible. Instead, it's programmed to run on popular versions of Windows (typically XP or newer) and nothing else: the return on investment from targeting older versions just isn't there. For example, attempting to run what ClamAV calls "Win.Trojan.Fraudload-3348" on a Win98 system crashes with the following error:
Other possible errors include missing DLLs
DLLs that explicitly require a newer version of Windows (this one requires "5.0 or newer"),
errors that are just plain strange,
and one I haven't been able to trigger to get a screenshot of, where a system library is missing an expected function. The last is probably your greatest protection, in fact: most programmers will, deliberately or accidentally, target Unicode-based systems. If you haven't installed the optional
unicow32.dll library on your Win9x system, Unicode-based programs can't run.