The safest course is to assume that if it's connected to the Internet, it's not secure.
Secure vs. not secure is not a black and white thing.
This isn't some situation that is unique to me. Most anyone could have their life messed up badly if someone got on their email and wanted to do them harm.
And yet, the black hats who breach such systems often have an attitude like "Wow, such a reputable organization has such sorry security. They deserve what I did to them".
Computer security is a black hole that will consume ever increasing amounts of money, memory, and cpu cycles, forever. What a waste.
That is defeatist and false. Computer security done intelligently can raise the cost of an attack above the value of what is being protected.
Once you start prioritizing it with money on security vs product/system engineering, security starts turning into a money monster that delivers nothing. I've seen it happen time and time again.
The asymmetric nature of raising the cost for an attacker is a red herring. You can pat yourself on the back that you've supposedly made it 100x more expensive to attack you, but one operational fuckup pops that fantasy bubble at any time.
Not to forget the many, many instances where security systems actively harmed / enabled attacks.
Security isn't some orthogonal concern that can be developed or managed independently.
The technical problem is that we should be ruthlessly eradicating undefined behavior at all levels of our hardware and software stacks, and to the extent possible constructing applications out of building blocks that are very difficult to misuse. Among other things, this means not writing software in C or C++, which is a hard sell to a lot of people (especially if they're writing operating systems).
The economic problem is that it's nearly impossible for a customer to know whether a product is secure or not. If secure products are more expensive to produce than insecure products and customers are not willing to pay more for secure products, the result is that insecure products will be more successful. (See George Ackerloff, The Market for Lemons.)
It all depends on your threat model, so who's going to attack you and what vectors and resources they'll have at their disposal.
Sure against nation state level attackers it's fair to say that no-one but the most well funded of groups will be able to entirely avoid compromise, but it's definitely possible to avoid most of the lower end attacks that are more realistically a likelihood for most Internet users.
Irony: Every government wants to authorize hacking at the state level, but nobody is rushing to secure their own infrastructure from being hacked.
The assumption that nothing is 100% secure shouldn't lead to people just giving up , but hopefully lead to them spending effort on detecting attempted and successful intrusions and in having effective responses to them.
Unfortunately, the parties that need this most are the least likely to implement it. The usual response to a question whether or not intrusion detection or exfiltration dectection / prevention measures are installed is 'What?', which I find a much more scary answer than 'No.'.
So there's a tendency to downplay those requirements (what OS or application vendor is going to say "hey you should deploy something for when our security fails on you")