If a "well-resourced attacker" was targeting you specifically, you're toast. Period.
Attackers come in all shapes and sizes. If the NSA comes after you, you’re toast, but there’s a lot of high level organized crime out there as well.
I wish more people understood this.
This is like the employer I used to work with who said "well google has been hacked so therefore us storing passwords in plaintext is okay". Maybe I'm toast if the NSA takes an interest, but there are an awful lot of bad actors out there without the level of funding or resources of the NSA. Of course I'll never be "100% secure", but making it as impossible, or at least as difficult as possible, for someone in Russia to socially engineer their way into my email is worth spending time and money on.
They could also compromise other people who need to know my plans and don't have the same security practises as me.
I think about this stuff and minimise as best I can, but my account security shouldn't be dependant on it.