The firewall to protect you is important
A firewall won't help you if personal information is online. It can only prevent incoming/out-coming connections (assuming it's two-way) which means you could prevent a malicious process from sending out telemetry data back to home, but if your data is online then your system doesn't need to be infected in the first place.
An attacker can social engineer services customer support and reset the login credentials to various services with the bare minimal of data about you, some services will be harder than others. Your e-mail is important because it can be a gateway to hijacking many, many accounts... And your phone protection is just as important (which is a worry considering so many phone network providers are socially engineered still to this day) because SMS verification can be destroyed if an attacker can hijack your phone network for your account by mistake of the employees.
Criminals tend to hack people's accounts and then sell-on the account to another criminal. More often than not, the criminal responsible for actual hack wants to wipe their hands clean from touching the clean funds from the hacked account to prevent being tracked down and busted. Instead, they will sell the account credentials on a bad forum/on a dark web area where they think they are "safe". Eventually, they likely will still be caught if their work has caused a lot of damage because resources are used on catching large value targets doing a lot of harm.
If someone hacked your Steam account and a few other of your accounts and sold them on but knew what they are doing, they probably aren't going to be caught and you probably aren't going to see your content again at ease. However, if that same person did it to hundreds/thousands of other people and generated an income of thousands of pounds from it, you can bet that they'll be a target by high-resources "attacker" to them like higher-up law enforcement/government agency.
There are people out there who have a career in trying to hack a customer and gain as much intelligence as possible. Legally of course. It works by someone coming to them and asking to be hacked to see how secure they are, and if the worker manages to hack them successfully, they help them improve to prevent it from happening the same way again. It ranges from social engineering the customers services customer support employees, spear phishing/malicious e-mail attachment attacks, etc.
If you worked at PayPal and a woman phoned you and you could hear baby crying in the background and this alleged woman shushing the baby to sleep and acting "panicky" in the sense that she has a bill to send to her other daughter's nursery by the end of the day and she has been locked out of her account, yet she is allegedly calling with the number linked to the target's PayPal account due to the changed Caller ID which you do not know about and knows basic information such as full name, date of birth and address, would you reset the credentials for her to the account? Most probably would. Even though this woman could have staged all of it.
There needs to be more forms of verification. Such as clicking a link from an e-mail and having the IP address matched to the range location of IP addresses used to sign into the account in the past, or putting combination codes in a specific order without hesitation.
