tldr: should the level of security measures applied to a GPG private key depend on the use case, or should it always be kept strictly protected?
I started using GPG a few years ago, I'm reasonably comfortable with the technical part but I'm still a bit confused about the broader security philosophy.
I use GPG mostly to encrypt my data and my passwords (with pass). I don't really use the signing feature since I don't have any need for it. Neither my data or my passwords are especially sensitive: of course it would be really annoying for me if somebody accessed all my passwords, but I doubt my data/passwords are valuable enough for anybody to go through the effort of cracking the encryption.
My private key is protected with a strong passphrase and stored in my laptop. I would easily let a friend or relative use my laptop for instance, but (1) I trust them and (2) they wouldn't even know where to look for the key. I'm now considering putting it also on my work computer for convenience. In theory this implies several risks: somebody could hack into the network and crack my password, and it would be even easier for an evil system administrator to access it. However these scenarios are quite unlikely in the first place, and the attacker would still have to crack the passphrase.
To sum up, I'm not really strict about the security of my private key for convenience reasons and because I think that the risk of somebody going through the trouble of stealing my key is very low. I assume that paranoid-level measures to protect one's private key apply to people who have much more to lose and/or are more likely targets than me.
Is my reasoning correct or am I being careless?
In other words, should the level of security measures applied to a GPG private key depend on the use case, or should it always be kept strictly protected?