1. Google/bing dorks still work well, burp suite..

2. Phishing still works, a few platforms steal MFA input - u2f/Fido is pretty robust tho. The trick is to find apps and federation that don’t enforce

3.you would see all kinds, no one size fits all

4. Really good shops and teams know the defense and countermeasures but the vast majority I would say don’t care

5. Infosec communities and such really are key - moves so damn fast

6. Learn how the sausage is made, I feel like I have way more insights from my Unix/network admin and SDE days which let me predict how stuff was put together - makes it so much easier to know how to break it. There is no quick path here though..