If there are exploitable remote execution attacks at the OS level that’s a pretty big hole to fill in with additional measures. Anything short of totally isolated would be a risk imo.