How vulnerable are offline users of bitaddress.org, who don’t use Ubuntu? By not installing Ubuntu and not removing the hard drive, I suppose I am vulnerable when I open bitaddress.org offline and enter the 64 random hexadecimal characters I have generated without a computer to find corresponding public address.

Yes, I clear the browser before re-connecting to the net. I never use the mouse to copy the private address (or indeed keep any computer record of it) but, if malware can pick up the 64 random hexadecimal characters which I typed in or if it can take a screenshot of the private WIF address I am screwed.
Depends on what you are going to do with your address. As for me there are three main cases to consider:


Will you store so huge amouts of bitcoin to fear attackers who are targeting yourself directly?
Are your computer as unsecure as most of non-technical people computers (and therefore: is it possible that it is already infected by some virus)?
Or last but not least: are you doing some controversial business and fear being spyed by government or someone else who may want to know either your private keys or just that certain address belongs to you?


In fact in everyday life situations there is no need for security better than just keeping your antivirus up to date and avoiding storing generated keys on disk (which could lead to a leak if your computer gets compromised in the future). Unless you've put all your savings in BTC.