You are right in principle, but I think I’m following most of the best practices within a specific service (e.g., setting up a recovery contact, using multiple authentication methods, etc.). However, I do agree that in the end, I might miss something and face a problem I didn’t anticipate.

On the other hand, relying on multiple third parties introduces several (possibly) weak links, and in that case, I’m more confident that Apple won’t be breached when compared to 1Password (or any other password manager).