I keep the silly Windows in a virtual machine or a few. Also standard hygiene applies such as opening files and attaching unknown media in a burner VM, not mix

I keep the silly Windows in a virtual machine or a few. Also standard hygiene applies such as opening files and attaching unknown media in a burner VM, not mixing banking, documents and entertainment, disabling autoplay and media icons if the previous options are inapplicable. Staying away from dodgy sites helps too. I generally do not have to keep the firewall or defender active as the routing (or lack thereof) is more effective. Also skip the automatic that pins everyone, such as remote device detection.