"as you can’t always depend on your antivirus program to save your skin in every case."
And this is why I do everything in purpose built VMs and only in the particular VM related to the action I am taking. I never surf the web or do any other dubious action from a VM setup to pay my bills online. I even go so far as to physically separate the VMs for general purpose internet activities to different physical VM hosts as to hopefully ensure that any exploitation of the VM host doesn't get to anything sensitive. The networks are VLANed with separate virtual routers which do not know the others exist as well. A lot of work for a sense of security, but it lets me sleep easier than if I were doing all of it from one bare metal OS/PC. I run all of this from repurposed/used, locally sourced, HP/Dell servers. You could, of course, do it with lesser equipment using a variety of lightweight VM software, I prefer ESXi and Hyper-V in tandem as I work with them daily as a profession.