Have real ad blocking in the browser.
(which would mitigate a lot of security risks by itself. I also note that people seem to do fine with desktop OSes, despite their outdated security models)
Also, a working foss ecosystem.