All the extra code isn't really the problem, it's the insanely easy to attack "programming language package ecosystems", like NPM, PyPI, etc, compared to something like the Linux package ecosystem. But this is a much less common problem than malware and phishing. Supply chain is more of a concern than it used to be, but thousands of people get infected with malware or phished every day, versus relatively few supply chain attacks that get caught fairly quickly.
For your own user security, my suggestion is to stop using SaaS wherever you can. None of them are secure, and exfiltration is child's play. All SaaS I've worked for had terrible security.
Malware typically depends on two things:
1) Unpatched software. OS, apps, routers, etc. Always keep everything up to date on patches. 0-day exploits are rarely used because it burns a valuable resource. If you can use an OS that has very little malware (like Linux, MacOS) it reduces your risk. Malware also tends to lurk in certain spaces on the internet (porn sites, pirated media, shareware downloads, malicious ads), so staying clear of them also reduces your risk.
2) Persistent credentials. Most malware (at least when I was looking at it years ago) isn't very advanced/persistent. An advanced persistent threat may sit on your machine indefinitely until you login using credentials, but they may not use those credentials immediately. Sign in and out quickly (don't "stay signed in") and always use MFA, ideally a second device. Secured Android and iPhone devices are ideal for checking bank statements etc... but you must be vigilant not to install untrusted apps from App Stores (anything not from a major company), as they are more likely to infect you than your browser on normal/safe websites. If you can, try to use virtual credit card numbers, and use a credit rather than debit card for purchases.
Phishing largely depends on clicking a link in an email, but also SMS "alerts" and browser pages that look like OS pop-ups. To defend against these, use a password manager to generate random unique passwords everywhere, use MFA everywhere. For login, set up and use 1-click-login and passkeys, especially for the most important logins (bank, email). Don't share or reuse passwords or API keys for more than one thing; not only does it reduce the impact, but it helps you identify where the compromise came from.
I personally play "fast and loose" on my Linux desktop and don't run things in isolation. But if you want rock-solid security, the only real option is running applications in dedicated VMs, and only mounting files needed for that application. Don't depend on containers or sandboxes for security. If you want a "lightweight" alternative to VMs/containers, you can have multiple user accounts on your computer, lock each user account down (no reading/writing from other user accounts), and either login to different ones for different tasks, or run apps as that user and have them display in your current user's desktop.