Personally I do it for both, but I also run pretty locked down on my daily driver Firefox (less so on Chrome, which I use for sites that Just Won't Run without

Personally I do it for both, but I also run pretty locked down on my daily driver Firefox (less so on Chrome, which I use for sites that Just Won't Run without a bunch of dependencies that I don't want to individually whitelist). For users I deal with, I do it as a preventive measure - I worry about phishing/spearphishing and other email vectored attacks, compromised websites, and the risk of a compromised ad network where even if something malicious is killed in minutes it could still reach tens of thousands of people. And I still get AV alerts at least a couple times a month where the AV has blocked access to something that's recognizably part of a remote access scam.