Security is not equal to privacy. Even if you do use 2FA and change your passwords all the time. You don’t gain any additional privacy.

Changing your google password and adding 2FA to your google account does nothing to make your life more private because google still can read all your emails, and sell your data regardless of 2FA.

The best habits to maintain privacy are to avoid using the services of companies that’s business model is violating your privacy.

Some pro privacy habits might be:

• Avoid any google products or services.
• Avoid and Meta products or services.
• Don’t use any free software or services that are not community run / non profit. They make money from selling your data.

In a positive light these habits might be reflected as:

• Using a google free phone. (i.e. GraphineOS or CalyxOS or /e/OS or even an iPhone as a last resort.)
• Use Lemmy, mastodon and other alternatives to big social media corps.
• Pay for reputable e-mail hosting with a reputable provider, (Ie Microsoft365 Business Account, Tutanota, or Proton Mail) or host your own.

Privacy isn’t all or nothing. Small steps are still improvements. Microsoft respects their business client’s privacy because that is what is demanded and Microsoft makes money by providing B2B services. Apple is in the business of selling expensive hardware and iCloud services so they don’t need to violate your privacy as much. These products while not perfect are leaps and bounds better then using any google or meta product.

Small steps are good steps.

If I had to choose one thing to do I would say to drop any phone that has the play store pre installed.