I don’t think this is a unfair statement to make.

The “petty threats” make up the large majority of risk for average users. Faaaar larger.

If your threat model includes worry about state level actors, Tails or QubesOS is the only thing I would recommend