I'd rank any or all of these higher:
- Don't open email attachments
- Use a strong password + 2FA
- Turn on automatic updates
- Don't run your own email/web server, contract it out to the pros
- Vet your donors, especially if they're dropping big bucks in return for "access"
- If you ain't comfy with it being on the front page of the Times/WSJ/CNN/Fox/Breitbart/HuffPo/NPR/InfoWars/RT/Youtube, don't (1) send it in an email, (2) say it at a campaign event, (3) include it in an SMS, (4) really consider it at all.
Same goes for the RNC and any aspiring politician, to be honest. But worrying that the Chinese or Russians have installed backdoors in a ZTE or Huawai phone? Eh, they've got easier and more precise ways to hack your stuff.