> just using PCI passthrough
On a laptop, I never got a working setup where I could attach/detach a modern nvidia card from host linux. So something that can do without is better.
But intel SRIOV is a thing as well, which should be the secure alternative.