Yeah like all security questions this comes down 100% to the individual's threat model.

For me it's enough to have a decoy or even just claim that the Lightning wallets on my phone are all the BTC I have because I'm just some unknown random guy who talks about Bitcoin. I don't tell anyone how much I have and I'm not especially wealthy or notable in any way.

If on the other hand I was a wealthy high profile bitcoiner who spoke at conferences etc, no this would not work and I'd probably use one of those cold storage services that holds BTC in underground airgapped servers or something.

And of course there's plenty of middleground options between those two extremes for various other threat models.

There's truthfully no one single answer here - it depends entirely on your threat model.