* These days hackers have a lot of resources and are often nation state actors. They utilize 0 day vulnerabilities. I don't see how an obscure OS will do any better than mainstream OS in terms of detecting and responding to exploits
* Many hacks actually start with social engineering, and human becomes the weakest point (well, in some sense, it always has been)
* Users, most of which are not computer experts, could make more mistakes when they are faced with software/interfaces they are not familiar with. (I'm just making this up, happy to see data that says otherwise.) "Open suspicious links in disposable VMs"? Sure, if they have received enough training and can do it perfectly, every single time, and never confuse the VM and the host environment. I'd say "never open suspicious links, forward the email to IT to help with you if needed", or even, just filtering untrusted domains in the email, is a much simpler and effective approach.