The truth is that we don't know if security experts are actually safer. Maybe the fact that they are experts makes them more confident that they can deal with an incident if such a thing arises. So it might be that they take more risks, but then are simply better at fixing things when they break.

We also don't have a ground truth for what users should do to stay safe online. Do updates work better than a strong password? Measuring the effectiveness of different security actions as scale is so challenging, that we don't now how to do it.