I think you might be over thinking it, though I can understand how it's a daunting question. I believe the intent is to ensure that it's understood the list is

I think you might be over thinking it, though I can understand how it's a daunting question. I believe the intent is to ensure that it's understood the list isn't a requirement, but rather the varying options and levels of secure you can have based on your wants/needs. When asking someone to create a threat model, you can begin with a simple question: "What are you afraid someone will do to your computer?" From this, you can then begin to piece through the list and look for items that address that. Just care about malware? Look at the scanning tools. Fearful that some bored teens in eastern europe are goofing around with hacking shit? Look at the security and notification tools Think Putin is sending the new FSB/KGB after you for your exfiltrated борщ recipe? Look at the disk encryption section. (and perhaps professional help) Maybe it could use some clarification, but I think the author's intent here was to convey that the list isn't a laundry list of "do this or your computer is going to be attacked", but more that you get what is required for your needs. Many of these tools require that you adopt different computing habits than traditional computing, and not all are applicable to every single use case.