Many problems in security culture end up being a combination of many small oversights. Take the paradigmatic example of Pax in Portland. They were a known anarchist and broke a window at night. A dyed lock of hair was visible outside their mask. They texted someone on textsecure a few blocks away from the window breaking. This and other things led to them getting arrested and charged and taking a plea.
None of these on their own was a huge fuckup, but combined they were! Going to a protest or actively working on a project (and I dont know how that unsecured copy was stored while not actively being worked on) are smaller and medium fuckups. But the enemy doesnt need you to fuck up big, just often enough. They only have to get lucky once, you have to get lucky every time.