You forgot using almost exclusively using GNU/Linux operating systems and Free/Libre Open-Source Software. That's another attack vector. I would know this, because I follow what I had just described, and even harden my OS's kernel too. It's simple as that.