What kind of security experts are they talking to... My personal list of most important things to do:

1. Run a version of Linux ( Windows is simply insecure )

2. Use Firefox + NoScript and only ever temporarilly allow JS to run as needed. ( JS is -not- safe and at any point in time there are at least a handful of zero day exploits )

3. Use an offline password manager ( KeePass )

4. Use a secure anonymous non-logging VPN for all internet use

5. Use a paid private email account, not some free one

6. Use VMs for running software that may not be safe