Yep, the public record stuff is pretty open - the deeper stuff you can definitively obscure, or use other counter-measures, though. . .little things, like using cash in brick-and-mortar retail, dithering your birthday on Facebook, or just having a minimal profile on FB or LinkedIn, with no useful info. Using a VPN service for web browsing is a good one, as well. If your situation requires it, a burner phone can be anonymous. There are even countermeasures for your newer vehicle's telematics.
I think the rational balance is to be just a little bit harder to hack than the average user - like the old joke abut the campers and the grizzly bear - you don't have to outrun the bear, just outrun one of your companions.
Hopefully, eventually, the Feds will start coming down hard on public companies that get hacked - they are no longer the victims, they are the incompetents. Imagine a bank that left their deposits on the front steps overnight, then claimed to have been robbed when the money is gone the next morning - yeah, they were robbed, but they failed in the simplest of duties. Given the current state of security, hacks are no longer inevitable, if the target is competent and using best practices. Just have to start frying people - it sure took way, way too long to fire the OPM IT chief, for example.