Whose website is this? Many of these look like Justin Maller's (IG)
I think you need a bit of Swiss cheese in your security philosophy. Relying only on your router's firewall is a single point of failure. If it fails you are screwed. Relying on multiple layers means if one layer fails, another one might save you.
If you are using Mullvad, just go to their web page and look at the top bar to see if you are connected to their VPN or not.
Not FOSS, but me and my friends have been using Tricount for years.
Have you heard of KDE Neon? Wikipedia says:
KDE neon is a Linux distribution developed by KDE based on Ubuntu long-term support (LTS) releases, bundled with a set of additional software repositories containing the latest versions of the Plasma 6 desktop environment/framework, Qt 6 toolkit and other compatible KDE software.
In theory, as the article mentions, you should be able to save them to your password manager of choice (if it supports passkeys, bitwarden does on the browser extension but not in the android app yet) and they will sync up through the cloud. So you might have just one passkey for GitHub for example and use that same one on all your devices to log into GitHub.
I'm out of the loop. What were the three instances of fishy behaviour by the Brave company?