Bought this computer when Win 7 came out and came with a free upgrade to Vista when that became available, and have since upgraded to WIN 10.. I keep up with all updates so that cuts down on vulnerability aspects considerably. So far the only problems I have encountered are adware, which I take out relatively quickly when I get them. Puter still works good, and since I go very few places anymore on the internet (compared to my past online activity profile) I am not that concerned. On top of that I do very little in the way of online banking & purchases nowadays. So my exposure is at a minimum. Also don’t have Facebook or any other social media type accounts that I am involved with. I checked and I am still running with BIOS (BIOS mode - Legacy), though I am sure I could switch to UEFI since I have a 64 bit system (system type - x64-based pc), but honestly do not know what that might involve to make that switch.
I was just pointing out that no matter what you do you could always do more.
I like having an easy-to-use backup, and I like to restore to a fresh install periodically. Part of it is I like to mess with computers and figure out how to do things. What I do is legitmate. What you do is legitmate.
The most important thing, as you pointed out, is to minimize your vulnerability, which you seem to be doing just fine.
One of the things I do to minimize my vulnerability is to never use a cell phone for anything involving a critical login to email or banking or online purchases. I do everything from my computer, and I never type in a password, I always copy and paste from KeePass.