1. Do not run a root account for regular stuff. This is a lot less common now since most distros require you to create a non-root account during install and a lot of the systems annoy you if you're running as root, but you'd be surprised by the sheer number of people who use accounts with UID 0 daily. This may also be caused by """more experienced""" friends/family setting it up that way to try cutting corners regarding access rights, but the bottom line is: don't be that person. Use root when necessary only.

2. Get into the habit of not blindly running every command you see online or trying every trick you read/hear, at least not on your main system. Try to setup a VM (or multiple) for the purpose of trying stuff out or running something you're not sure what the impact might be.

3. Keep your system updated, from kernel to userland.

4. Get into the habit of reading news regarding exploits, malware and the responses for them. You don't need to become an infosec professional or even understand what they actually do. What is important is for you to learn what to avoid and when something really bad is discovered so you can update as soon as possible.

These 4 steps are arguably more important and create better results than any anti-virus could ever hope to do for you. They won't ever get to 100% security, but then again, nothing will.