Mixed bag here. I would caution first that "experts" often make mistakes and bad assumptions too, so it's no surprise their recommendations are sometimes flawed. They're just less likely to be outright wrong than a layman.
Updates, I'd say 90% of the time, are to address security concerns. Therefore it's highly counterproductive to simply ignore updates and patches. I've only had two updates in the last 10 years that have caused any problems, and both situations were my fault. I do think the user should have control, because often times I've had updates start running while I'm doing something and suddenly I'm thinking I broke something.
Anti-virus software is like a trusty backup. It should neither be your first or only security step, but it should be a part of the package.
Passwords have gotten a bad rep. Few hackers actually use passwords anymore to access systems the way movies have painted the use over the years. Hackers are sitting there pooling through password option to guess your password. All you need is an uncommon, not easily guessed, password. Putting your passwords in a manager is like taking all your money from every bank or credit card or whatever you have, and sticking it in one bank. That bank falls, there goes all your money. Same with password managers; you've taken several fail points and made just one. Changing it all the time is also of minimal benefit. Somone steals your password once, at a single instant. It doens't matter if you changed your passwrod this morning, or 7 years ago.
Finally, and this one kills me, the "only visit websites you know" thing is pure stupidity. Facebook, Twitter, heck, even Tom's would have never made it anywhere if no one ever went to any website they had never went to before or were somehow so close to the developers of that they felt comfortable going there. It is a foolish notion and highly impractical. Obviously avoid known bad sites, but you're going to find yourself in a little bubble if you bar any website you've never visited. It's like avoiding any restaurant you've never been to because you're afraid of food poisoning.
Facebook
Twitter
Instagram