I am increasingly feeling that security is really not about "talent," but about habits formed over time.

When your assets are still small, using a hardware wallet to keep the signing step in your own hands is actually enough; the key is that each transfer is a bit slow: first check the address, check the authorization, check the slippage, don’t be quick to click.

Once the amount grows and you start moving funds frequently, multi-signature becomes very appealing, even if it’s a bit more troublesome, but it can turn "a moment of reckless decision" into "a need to confirm once more."
Recently, cross-chain bridges have had issues again, and oracles report outrageous prices, and everyone is just waiting for confirmation…
Honestly, it’s about not putting too much trust in single points of failure.

I also use social recovery, but I set rules for myself: contacts should be diversified, and I regularly practice the recovery process; not practicing is the same as not setting it up.
Anyway, security isn’t something you just set up once and forget; it needs to be part of your daily routine.