This is best that you do not click emails you do not recognize on the mail connected to your financial dealings, better if you have a dedicated email account for your exchanges and co and never use it for anything else, so whenever a new mail, even recognized ones pops up, you don't click anything from the email, you go to the account of interest, log into it and check if the mail exists in it's notifications and attend to such from the relevant app and not from email notifications. It would help you only attend to verified information. Additionally, use a separate device for your bitcoin and other crypto activities.

 Yeah, actually although most times you wouldn't want to pay Tx fees on every UTXO that hits your exchange account, so possibly the exchange account can serve as a consolidation point for your coins until it reaches a definite amount and you send it to your non-custodial wallet. I set a limit of coins existing in my exchange to not more than $3k, as soon as that sum is achieved, off it goes to my decentralized wallet.