Yeah that's the ticket.
Actually that's kind of what I do with my work desktop machine. Get it all tweaked and do my best to never install anything again. Anything I need for a one shot use I install on a test machine, I don't care what spyware or anything else lands on a test machine it'll be scrubbed in under a week anyway.
Never, in my 30 years of working with computers, have I ever had a problem that did not involve the installation of new software.
Each and every time, I could always trace the problem back to new software being installed.
Ah, the good old days of the Altair 8800 with the front toggle switches. Even if an evil programmer did try to sabotage my computer, it would take him days to finger in the software code.
As long as nobody touched any of the front switches, that computer ran great.