I'm gonna go for taking reasonable action of fortification and then try my luck.

And negative, usable security is a delicate balance of security and convenience. It employs various layers of usable redundant security methods that keep things to the best possible and reasonable level of security available, while also maintaining useful defense. If I were doing anything rendering me a target of a malicious actor, that's a different story. But run of the mill individual passwords for each website/service coupled with 2FA along with password database encryption is enough to keep a nobody like me reasonably comfortable.