Why should I treat my Arch installation as hostile? Seems unreasonably paranoid.

In case of supply chain attacks? Running a minimal OS that then runs everything else in VMs seems an effective way to minimise damage.