You're making a lot of assumptions, projecting, maybe?

I do have dedicated machines and dedicated VMs for agents.

RCE on a VM is still a RCE.