Risk is equal to severity of the outcome multiplied by the chance of that outcome. If I were running a bank, I'd probably be very careful about what Linux distros I use. But for my own personal data, I don't think the CCP or Russia are going to be able to do anything meaningful based on my RedTube browsing history or my Wikipedia deep dives into penguin morphology.