For high value targets, probably. For average spear phising I don't think they spend more resources to break out from docker. Since default docker runs linux,

For high value targets, probably. For average spear phising I don't think they spend more resources to break out from docker. Since default docker runs linux, running the browser in a linux docker can be enough, because they usually have windows exploits.