You’re being too pessimistic. Password manager, changing device defaults, backups, and access controls are all very good recommendations, if a little basic.

The rest is indeed more of a compliance thing, but plenty of small businesses won’t do the 4 things I mentioned above.