If you kept only three of these tools, which three? Everything else I set up I abandoned inside a month

Password manager with unique passwords everywhere, an alias or plus address per service, and keeping the operating system and browser actually updated. Those three survived nine years for me because none of them require a decision at the moment of use, they either work invisibly or they are one autofill away. The ones that died were the ones with a per use cost: a VPN you have to turn off for a banking site, a browser that breaks a work tool, a DNS filter that quietly kills a link somebody sent you. Anything with a per use cost eventually loses to a bad Tuesday, which is precisely what you have described.

Aliases earn their place with evidence, which is the part I like about them. I have 214 of them after two and a bit years, and 11 have received mail from someone other than the service I created them for, including two well known retailers and one charity. Each one told me exactly who leaked or sold my address, and turning off a compromised alias took about four seconds. No other tool on my list has ever produced that kind of concrete result.

Password manager, unique addresses, updates. Everything else is a hobby, and hobbies stop when you are busy.

I would swap one of those for DNS filtering, but only if you do it at the router rather than per device. Done at the router it has no per use cost at all, everyone in the house gets it, and nothing needs installing on a phone. Done per device it is exactly the kind of thing you disable at work and never turn back on, which is how it died for you.

The hardened browser is the one that got me too. Two of our internal tools broke, I set an exception, then another, then I was running a browser with a page of exceptions that was no longer hardened in any meaningful way. Now I run the strict browser as my personal one and a plain one for work, and that separation is the only reason either survives.