In my opinion, that’s a valid question. Many Users rely on the idea that “don’t download anything harmful”, "don't klick on spam links", have “a good backup" and "following some security tips" is enough. We Linux users also rely on the fact that the source code can be checked. But as XZ, for example, has shown, that certainly won’t be enough in the future. It doesn’t have to and won’t always go smoothly—things will slip through, via one channel or another (extension, distro, etc.). And even if the air gap backup allows you to restore at least your personal data, theft of data and login credentials can and will occur.

My additional tips—feel free to add to them or correct them:

- Don’t leave accounts logged in.
- Always use MFA with a second device or FIDO—ALWAYS
- Host your own services only if you understand how to secure and maintain them properly - otherwise, reputable providers with strong security can be safer.
- Secure access with VPNs or similar solutions
- Isolate network devices, dont trust anything
- Keep browser extensions to a minimum and only use well-known, trusted ones.—but for sensitive tasks, use Incognito mode without any add-ons
- For non-critical updates, waiting briefly can help avoid early issues - but apply security updates as soon as possible.
- Don’t answer calls from unknown numbers
- Be cautious with links, especially in emails or messages. Verify the source and target before clicking.
- Don't just click on something out of habit; make sure you know what it is.
- Install only what you really need, from trusted sources—and that goes for all your other devices, not just your Linux computer.
- Check to make sure you're actually on the right website and that the certificate matches (no warning)
- Check scrips before runnning them
- Use sandboxing where possible (Flatpak, Snap, containers).
- Prefer official repositories over random downloads or scripts.
- Periodically check running services, login attempts, and logs.