I agree a lot more can be done but if you look at how advanced some of the state level groups (like APT-29) are if you are truly a target it's tough even if you follow all the best practices.