Just use a VPN. There are many attack vectors without even touching software exploits. On windows for example wpad will get all your traffic hijacked. On any OS

Just use a VPN. There are many attack vectors without even touching software exploits. On windows for example wpad will get all your traffic hijacked. On any OS there are non-browser processes that make unencrypted network connections as well. Even if you only allow https and check every single cert, the sites you visit (domain/host) are exposed via SNI on TLS which is a privacy risk.