I would add another point - use antiviruses on your devices, which will protect you from phishing activities, especially when you log into your emails.
I don't think phishing works like that. You get phished by a phisher by making you log-in to a website that looks similar to a particular website. I have Eset on my computer and I can still access phishing websites. So what it comes down to is the gullibility of the user since your computer can't autofilter all of these websites. My advise is to not login or signup to sketchy websites. There's also another way of getting hacked and it's by signing up to a particular website with your email and a password similar to your email's password. It is not advisable to have similar passwords. Of course over time we will be needing to sign up in multiple websites and if we were to use different passwords to each, we might forget about them. What I personally do is write them down or I just recover the password through email everytime I log in but that's actually very inefficient.
Using a virtual machine for getting access to your wallets and exchanges is also a common practice (though not everybody is technically smart enough to install and operate a VM).
No one is, by default, technically smart. Everyone had to learn and everyone had to do their part. You can never be tech savvy if you never expose yourself to this type of things. A tech savvy and a non-tech savvy have the same circuitry in their brain so there's no reason as to why someone wouldn't be able to operate a VM. They just have to study how.
Here are some links I have found to be useful:
*
What is a virtual machine? (Youtube)
*
Setting up a virtual machine (Youtube)
And if you prefer reading them instead:
*
Quora.com: Virtual Machine in Layman's Terms (Layman's Terms would mean that someone who has zero knowledge about the subject should be able to understand it, so I recommend checking this out)
*
How to create and use virtual machines (HowToGeek)