.
Being careful online, such as not downloading things you aren't sure of and not clicking on unfamiliar links someone sends you, are also good basic things. As for VPN, I think it's more about privacy than about security. I use it occasionally, but I don't think it's related much to using or not using Bitcoin.
Sometimes people click on links by mistake that appear perfectly legitimate but turns out to be a fake website that installs very dangerous viruses and malware.
Security software such as Malwarebytes browser extension will block you from visiting such websites.
If you type in a URL of a well-known legitimate website, but mistype it by one letter you could be directed to a fake website that looks exactly like the real thing.
That is how people accidentally download malware, viruses, keyloggers that can record all your keystrokes, etc that steals your personal and financial information including your passwords.
That could lead to catastrophe for you. In such a situation a hardware wallet alone will not save you. It doesn't matter if you have Linux or whatever operating system you are screwed.
Unless you are a robot that never makes a mistake and never makes a typo it is foolish to believe that you are perfect and will never make a simple human error.