Your first point ("Kept up with OS X system patches") is probably the most important. If you trace the history of exploits on OS X, most have come from:
- Giving privileges to unknown apps or clicking on unknown links
I'm not a security expert, but it seems like limiting your exposure to those things will decrease your exposure significantly.
Java shouldn't be installed if you don't need it, and should only be turned on for the time you use it, if you do need it.
The same is true for Flash. If Safari is your browser of choice, then grab Chrome and Switch to open pages with Flash in Chrome (and only the pages that require Flash). Chrome has a sandbox for Flash and is considered quite safe.
Applying Apple's patches should (eventually) save you from any PDF exploits. Using OS X's Preview to view PDFs rather than Adobe Acrobat is a good idea, too.
Keeping your browser up to date and limiting the amount of extensions you use is a good idea. Safari has an "Open safe files after downloading" option. If you're tuning for security, that's best turned off. Safari also includes malware detection. The latest Chrome and Firefox also make good browser choices.
Giving privileges to unknown apps or clicking on unknown links
Being super careful with links you click on and apps that ask for admin privileges also helps stop trojans and malware from doing bad things. If a service has sent you an email notification about something you need to take action on, you may be better visiting the site using your own bookmarks and not by clicking a link if the email, if you're suspicious of the email's origin.
Many different and long passwords
Using something like 1Password to generate and store your passwords can help, because it means you have a different password for each service, and they can be a huge string of seemingly random letters and numbers. Here's one I just generated as an example: lyLEnrFDnoDoBoS90PJZ. Doing so also means you can ensure your main computer (and 1Password) passwords are never used for websites or web services.
Long passwords take a long time to hack for brute force attacks. And using different passwords for everything means that one compromised service won't give the attacker your password for other services.
There's quite a few alternatives to 1Password, including OS X's in-built keychain (which is free with OS X).
Follow Mac tech blogs
If all else fails, and there's some kind of exploit that you're vulnerable to, you'll want to find out as soon as possible. Chances are it'll be big tech news, so following a few popular Mac tech sites should notify you within a day or so of the issue and you can take the needed action. The recent Flashback trojan has been big news. I found out about it because I follow Daring Fireball and Macworld. (It uses a Java exploit, so disabling or not installing Java would have saved you in that case.)