
In my home lab I have them separate the OPNSense box has full performance on its own HW, only needs to be patched once in a while and is super stable.
I have managed to crash / lockup one of my proxmox hosts at least once while messing around with HW past though or by giving a guest enough cores to slow the whole box down.
Family never gets interrupted playing games or streaming Netflix with my lab separate from the critical internet service.
New versions of OPNsense installed with ZFS support snapshots before upgrading natively sort of taking one of the promox vm tricks out of the pro list making it neutral.
A few releases ago they made it so you can DEFAULT new entities NOT to be controlled by the VA… I cleared ALL entities and changed the setting. I only add things one at a time to voice control now.
SO many integrations ad switches it is a high risk to default the VA to have access to all new ones.