While I always prize people how invest time and share results of their work to the community I found that list a bit of a collection of common things, some not really good beliefs etc, so my two cents little contribution:
- two factor auth depending on the secondary factor might be a vulnerability itself: suppose you use Google Authenticator on your Android "phone", what if a third party deliberate action DOS your phone (not functioning anymore, locked etc, no matter the reason): you are cut out of other available/working service because of the OTP SPOF, so at least chose recovery roads if the OTP can't be used in all cases, and test them regularly;
- a "secure password manager" is something you read in code and understand everything, also is as secure as the environment it live on, for instance on Android/iOS/other proprietary OS you can't trust any password manager not because themselves but because you can't trust the environment you are in, the only option is using only community born and community developed FLOSS [1] witch is limited by the hw+firmware layer on top on nearly all modern common hw;
- breach alerts are generally good BUT also a potential privacy issue, follow news on services you use is the good (and hard, not because of nature but because most services do not offer a simple very-low-traffic RSS feed/ML alerts with just critical infos) BUT remember you give personal infos, public, but still personal, to a third party witch maybe honest and/or maybe itself breached just to munge data from it;
- safe backups are backups you restore regularly and that are stored offline. The offsite backup is for physical safety (earthquake, thief at home, etc) BUT it's not really "safe" since is not really under your control (unless you are big enough to have geographically distributed personal infra);
- for emails, having many it's ok, as long as you give some to your contacts so they can know and trust that's still you who write from another address, but the main point are mails themselves: they are personal, you need to have them, witch means do sync/download your maildirs locally in an automated fashion and USE them locally with an MUA (or if you really need a personally hosted WebMUA, because emails does not matter only in terms of "current capacity to read and send" but also search through your maildirs, perhaps through all at once if they are many, having your MUA to work with not n-th different WebMails from different providers etc AND have mailbox portability witch means having personal domain names so to been able to switch from a hosting partner to another without changing address. Also a personal mail typically allow many aliases, witch are useful to give to services from retail to NL etc to been able to detach easily and to know where the spam came from (i.e. if a spam mail arrive to my ebay065 mail alias that means someone from ebay got mail mail), oh BTW there is no "secure email provider" (if you are yourself the provider) just different services you can choose to trust or not, without much data to decide;
- for chat, I laugh a bit because if the author talk about chat on smartphones they do not matter how open or safe they are, they are on surveillance capitalism platform so NONE can be trusted for privacy, even one you write yourself;
- "use a VPN", in the sense of commercial VPNs providers is a VERY BAD ADVISE, my ISP can spoof my connection but it's a company from my country subjects to laws I know, I can have a local litige with my local lawyer etc a third party VPN service based in British Virgin Island, Cayman or You-name-it remote -stan it's essentially protected by the impossibility in practice to sue it, so it's the opposite of safety: you voluntary give 100% of your network usage, perhaps with a unique account for multiple devices, to a third party renouncing to your local laws protection. VPNs have ONLY a safety purpose: connecting LANs across the internet, witch means if you have a homeserver and you want to route all your traffic through a VPN is safe, otherwise might just be a means to circumvent Geoblocking NOTHING for safety nor privacy. Oh, BTW forcing a LAN-wide VPN especially through a commercial router is again not a good idea but at minimum a SPOF.
- for a safe LAN avoid wireless at all, at least limiting it to not-easy-to-connect-via-wires devices (smartphones) AND for ephemeral connections (guests at home etc).
- for desktops: IMVHO do NOT USE any antivirus, simply use OSes that do not have "try-to-execute and fallback thereafter", antiviruses especially proprietary ones are extremely invasive and not trusted beasts. Backups MUST BE for all data, not "just for important ones" because restore MUST BE a full restore from the system/configs to data. Partials backups are good recipes to make disasters.
[1] witch means code that many third parties with different interests, scattered around the world have seen from the start, when the codebase was small enough to be really understood ad a whole.