The more you do, the larger your attack surface becomes. The larger your attack surface, the more you have to protect. The more you have to protect, the greater the statistical chance something slips through and you get breached.
For most people who are genuinely OPSEC aware, the bar is surprisingly low:
- Use strong, simple encryption where it matters (full-disk, messaging, passwords).
- Avoid leaving a digital footprint when doing anything sensitive or "stupid". You can even throw your phone away if you can bear the inconvenience.
- Ruthlessly minimize the technologies, accounts, and services you rely on.
This approach places you ahead of the vast majority of self-proclaimed "security-conscious" people and will have you run laps around the extra-legal hypocrites.
Too many are actively booby-trapping themselves in the pursuit of flexing the latest encrypted phone, hardened OS, anonymous VPN stack, or obscure privacy gadget. While the examples are in tech, dependencies can also be environmental or human. Every additional black box you introduce is something you don't fully understand: unknown firmware, unvetted supply chains, telemetry you can't see, update mechanisms that could be subverted, or side-channels you never considered. The more opaque layers you stack for "protection," the less visibility you have into your actual attack surface and how well (or poorly) your defenses are really configured.
Security is, and always has been, incorporated on a SOP level. So assuming breach is inevitable (or has possibly already happened). Just live your life accordingly, constantly aware that your actions might be observed, logged, or reconstructed like Jim Carry's in The Truman Show.