Might sound a bit of a silly question. I see people talking about threat models, and privacy guides which say things like “if this is part of your threat model, do X Y Z”. I’m just not sure if it’s a general “this is what I want to protect myself against” or if there’s more to it.
I mean, yeah, it’s the threats you’re trying to protect against. Usually informed by which attackers are likely to go after you and what avenues they are likely to take, but you can decide based on whatever you like.