Only other piece I would add to your great list: have at least one on-site and one off-site backup of your password manager, you’re 2FA codes, and your data.

Can you explain the VPN part a bit more? What do you mean with discretion here?