This will provide decent privacy for most people against casual mass-surveilance. But you should not assume that it's anything like sufficient protection against these kinds of state-sponsored attacks.

Assume nothing electronic/digital is safe? That's my take-away.

Nothing non-electronic/non-digital is safe either. They just have different tradeoffs.

Strictly speaking, even being alive is not safe.

This is absolutely not enough against targeted attacks. It will be harder to detect you but once they do, Firefox (which Tor is based on) is a lot more vulnerable than Chrome. Same for Android, the locked bootloader and such can be helpful in this situation.

2 phones. One is used only for hostspot. Second is used only in wifi mode. You take a sim card that you can obtain without id. Register signal, whatsapp, whatever with pin on the second phone. Use threema. Second phone should be rooted with very strict firewall. That should make someone sweat if they want to get in the endpoint.