I think almost always the DB query will take the longest but: I've seen too many engineers not even do basic optimizations such as creating indexes.

Here's a list of easy/low hanging fruit optimizations that are often just forgotten: Creating indexes in the db, delegating more logic to the db than doing it in code (e.g. using pipelines in mongodb, partial indexes in postgres, etc.), turning on brotli/zstd compression for all or most requests, caching objects or requests in memory (e.g. with redis), setting appropriate cache control headers, frontend stuff such as not rendering thousands of objects as DOM nodes and instead using canvas (recently saw this in a map application).