Once I learned / realized the whole idea of a smaller company having a data breach and exposing your “universal” password, all of my accounts have unique, randomly generated passwords so that if one is compromised, it’s only that one. Also MFA whenever possible and (maybe overkill for some) rotating passwords on a consistent basis.