That’s mostly true, I really had in mind local exploits At the same time, you should use application layer proxies (eg http) that have little or no privileges

That’s mostly true, I really had in mind local exploits At the same time, you should use application layer proxies (eg http) that have little or no privileges in your system, nothing else running, as restricted as possible, etc. don’t expose more general hosts to direct raw IP traffic from the internet.