a VM with torrent client and a killswitched VPN

You can use Docker for the same setup using the –network container:vpn flag to docker run or network_mode: “container:vpn” option in docker-compose.yml where vpn is the name of the container to route through. This makes one Docker container use the network of another (the VPN one), so both containers will share the same internal IP address, and you’ll have to map any ports on the VPN container rather than the torrent/whatever one. This is just as safe as a killswitched VPN.

also meant if it ever got virused I could just roll it back

Consider using a file system that has snapshots, like ZFS. Then you can get this same behaviour for your whole system rather than just a VM :)

is it ok to sit on the perpetual license (for a few years at a time), or are the updates really required?

I’m not sure, as the new licensing model is pretty new. I purchased Unraid in 2023, and back then, all licenses included lifetime updates. They switched to a subscription mode to make the business more viable long-term and afford to hire more developers, which I definitely understand.

It supports GPU passthrough right

It does. You can pass through any PCIe devices, so for example if you have multiple network cards, you can pass one directly to a VM (it’s a bit more efficient compared to using a virtual Ethernet adapter)