If you're at the point where your biggest threat is a SE attack on a major cell provider I think you're doing pretty good with security.
These are things that have actually happened.
Social engineering has shown that it's just about effortless to take down someone once they are targeted. It's about as hard to target someone as it is to read their whois address to a customer support rep.
This blog post publicise Microsoft implementation but it’s the same problematic for every possible GAFAM specific solution.
Apple approach to include a secure and synced password manager in all their product is far more standard friendly approach imho.