At most 3 is incorrect.
Not counting MH17, there are at least four civilian passenger aircraft that were definitively shot down by missiles, and more that were suspected to be (or were definitively shot down, but where I can't find definitive information on the "by missiles" part) in the last 30 years:
LN 602 (March 23, 2007): attributed to the Tamil Tigers using Manpad missiles
Siberia Airlines 1812 (October 4, 2001): admitted shot down by Ukrainian military
Two Transair Georgia flights (September 21-22, 1993): shot down by missiles fired by rebels
Iran Air 655 (July 3, 1988): shot down by the USS Vincennes
Air Malawi 7Q-YMB (November 6, 1987): shot down by Mozambique (can't find anything one way or the other about whether this was "by anti-aircraft missiles" rather than, say, guns, so maybe not technically within scope.)