Configure all machines in a way that they can survive on some random untrusted public wifi. This should be the obvious default stance for laptops and phones. B

Configure all machines in a way that they can survive on some random untrusted public wifi. This should be the obvious default stance for laptops and phones. But even for workstations wired to a trusted LAN it still makes sense because you never know which of the various tunnels might assign and expose some IPv6 address to the internet. For servers you might be able to make an exception if you have a vigilant IT and the people with admin access aren't actively trying to circumvent security, but even then that better not be your only layer of security.