If I wanted my computing device to be as secure as possible against state actors, I would compile all the software myself, and tweak a few compiler settings for my builds.

It's super hard to make an exploit work when you don't know what options your target was compiled with.

Also, simple things like swapping malloc implementations or changing some parameters of malloc will pretty much make your device immune to state sponsored attacks.

Also, anytime you see an application crash, record all crashdumps - since they will contain evidence of a failed exploitation attempt.