I'm an enterprise guy, so that's the explanation for non home use things.

• VPN for anything not my web or certificate revocation distribution point
• Sophos IPS
• sophos utm for web application firewall
• transparent inline web proxy, sophos is doing https inspection. I have internal CA and all clients trust it. I don't inspect medical or banking, other common sense stuff.
• heavily vlan segmented with firewall between
• my windows clients are managed by active directory with heavy handed GPOs.
• least priv accounts, different accounts for workstation admin, server, domain, network devices
• security Onion IDS
• separate red forest that has admin accounts for my management access and accounts on devices
• trellix antivirus and global reputation based file monitoring
• I've started applying disa STIGs on servers
• site to site VPN with other family member household. They get managed trellix av also.
• my public identity accounts like MS,.Google, etc all need 2fa, token, etc.

I bet this can still get exploited, just would take effort hopefully none does for a home network.

I'm still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.