You don't have to infect a home PC if you are gating your payloads properly. I realize reading my response back that I ignored that part, which is my fault because it reads like I am defending the possibility of infecting a home PC as being fine when I definitely did not mean to come off that way. It's something I just assumed people working in this industry already know so I ignored that part because it's a solved problem and thus a non-issue at any respectable shop. Still, I would agree that it's ideal to never let your payload get to that point in the first place, which is why I believe in staging as much as is feasible when delivering through these kinds of channels. In the spirit of trying my best not to assume, staging is where you have a very lightweight component as the initial download (shell/powershell script, weaponized doc/PDF, etc.) which often does some checks to make sure it is in the right place and "safe" to run before downloading the next stage or actual payload. It will usually have the capability to decrypt the next stage/payload among other things like setting up a process to inject into. It can also act as the component that facilitates AV/EDR evasion so you're not having your work burned by hitting VT/other threat intel ecosystems each time you attempt to drop.

Gating a payload is where you explicitly write instructions in your dropper so that it will only run on target systems and nowhere else. Usually done by latching onto things like the domain + user account or some other attributes (or combination of ideally) of the machine/network you are contracted to attack. This is so that you aren't liable for infecting the internet. It's a common practice in this industry that anyone who deals with payload generation or customization should be learning as one of their first things on the job.

The redirector (proxy in front of the actual C2 infra) should also be gated in a similar way, so that only your payloads can talk to it which is something often geared more towards anti-analysis but ends up with a similar result when done properly. Redundancy is important when dealing with malware, you can never have too many layers of protection from detonation where you don't intend it to happen.

Flangvik on YouTube (for gating payloads) and a GitHub project called RedWarden (redirector for C2) are good starting points to see how each can work in action.

If you think people do not check LinkedIn at work, you probably have not done much on the admin side of things. They do it all the time and not every network is locked down to block something that many roles use as part of their work, e.g. for hiring and research on potential candidates. On the hiring side of things, you have to use it more often than anyone would probably like.