It's not like any of the individual measures I've been applying (network segmentation, rootless containers, readonly filesystems, compartmentalizing secrets/keys...) acts as a silver bullet, but seeing the clusterfuck that we are living these days on the Internet... I'm happy of having been a bit paranoid with the security of my systems (to the extend of my abilities).
I still have to update a lot of stuff all the time, but at least I have some extra margin to react (in comparison to the common case).