Also worth noting, the majority of the time security breaches are because of the person behind the screen, and not the software. Since, usually its easier for a attacker to target someone who has weaknesses, and only one mind, than to attack software which has been out for years, tested by thousands, and being actively developed. I'm not saying that software isn't targeted because it most certainly is. This is especially true, when it comes to privacy. There's a lot of software which is specifically designed to keep your privacy in tact, but its usually the end user which compromises it by misusing the software, or simply by making a mistake.
So, although its always best to take security seriously, and follow the advice of the experts, you should be taking precautions against your mistakes that can creep in through complacency, which is something privacy, anti virus software, and security measures can induce by giving an illusion of safety.
Btw since the secret answer is no longer considered and is even play with death, why do we still have it and why wasn't it changed? Despite the fact that I highly agree and confirm that it's our responsibility to take care of our accounts and there is no need to blame others for your mistakes, I think additional security wouldn't be a bad, especially for those who are very sensitive regarding this and prefer an extra layer of protection.
Finding the balance between security, and user experience is difficult. Depending on your user base, some might require strict security practices, where others may find convenient ways of retrieving their accounts beneficial if they so happen to lose the account. Without being too stereotypical, this is quite common in the older generations, where they become forgetful of their credentials, or simply don't want to go through all the security protocols to retrieve their data. As far as I'm concerned a security question is a flawed design, because of the way its presented. A lot of websites do it far worse, and make you choose between a predefined question, which means its usually asking a personalized question such as "what was your first pets name", now you could do a random answer length should be treated just as important as a password though), but usually people find this convenient to remember, and put in their actual data, which is usually easily found out with social engineering. Especially, of the age of social media where pretty much everyone documents their life, sometimes without even realizing the data they're presenting to the world.