everyone has a different threat model
you could just call yourself lucky for not using best practices.
So far....