Some scattered thoughts on this:

* Don't always immediately updated to the newest version. If it's compromised, give the other users and the vendor time to find the vulnerability.

* Try to rely on software packaged by somebody you trust.

* Reduce potential impact of compromise by using 2FA with something off your dev machine (like authenticator app on your phone).

> What's the bar for reasonable security, in your opinion?

That really depends on your situation.

Do you think somebody might target you, specifically? Has your machine been compromised before? Do you do anything with potentially high leverage for an attacker?

If the answer is "no" to all these, I'd say don't sweat it too much beyond standard "best practices".