Android OS, Firefox Browser with ublock and ABP, who gives a shit about cookies, vpn's aren't needed unless you are trying to access region restricted information and data, lock down mode is probably excessive. You are probably not important enough to worry about most of those. The biggest issue for regular users is understanding when to open emails and click links. Most people make the mistake of clicking the wrong thing or opening the wrong email or message and then they get targeted by scammers. That's the biggest risk most average people face is getting their info into the hands of scammers. State-level hackers don't give a shit about anybody that doesn't have some government access. If you don't work for the government in your country then most state-level hacker's don't care about you.

Just practice good habits when it comes to opening links and visiting good and bad websites.