All of these are best security practices. But read more about the swiss cheese model to know why you can’t just tell someone, “run a vulnerable os, you’ll be fine so long as you are perfect and nothing goes wrong.”