Presumably only the homedirs of the servers.

You want a world where a browser exploit can drop a bootkit? Nahhh

They could just drop something in bashrc or somewhere else for a persistent exploit. The system files contain nothing worth touching on a personal device.

Persistent userspace. And while I understand privesc in major platforms is not the insurmountable problem it seems, it is still a layer of protection important to the model of preventing SMM, hypervisor efi boot and root level persistence, without something else up its sleeves.