As in the xz vulnerability, many exploits rely on some sort of open listener directly to the internet.

So with that, you can go a long way by not exposing anything at all to the internet. If you want to host private services use a VPN or zt mesh like nebula.

That won't solve everything, but it's a start.