"the attacker probably won't intercept the mail and install rootkits on brand new hardware"

"the attacker probably won't read my password through the wall from the radiation off my keyboard"

if your starting point is APT-level adversary then you might as well give up