There's the full secure extreme — turning it off and unplugging it — but the usability tradeoff isn't great. TFA lies somewhere along that spectrum, but it isn't clear to me it's a sane default.

(It is not especially clear to me what exact mitigations TFA describes; it seems to be glossy ad copy rather than technical documentation.)

I'm not sure I'd want "!!!" log lines going to the primary business log when only the suspicion of an attack exists.