In case of supply chain attacks? Running a minimal OS that then runs everything else in VMs seems an effective way to minimise damage.