Qubes is awesome, I think the main thing it protects against though is an application you don't trust too much escalating it's privileges (for example a website sandbox escapes into the browser and then tries to go up further) - Since we're on an air-gapped, immutable system all the tools we have on our CD have some implicit trust, so if you manage to get software that isn't playing nice onto the OS, you've probably done it through hijacking the OS CD anyway (I covered a similar-ish question here: https://community.monzo.com/t/how-we-protect-our-most-sensit... )

We also don't run that many complex commands on the actual OS, it's basically one of three things 99% of the time:

- Mount this CD containing some CSRs or etc

- Ask the HSM to please sign this

- Burn a CD with these files and then report the hash / PGP word list of the content on the CD