Replymessage unavailable
If you're doing it as a hobby, you can use free public sandboxes. That should absolve you from the worry if your infrastructure is getting owned. Chances of that happening are low, especially if you give the VM no outside (nor local) connection.
Anyway, context is key. So if you get a totally random sample, you will need to figure out what the context is. A sandbox can easily provide you with sufficient context. With sufficient experience, you can forego the sandbox analysis and dive straight into static analysis, but this can also waste your time to a certain extend. If I load a file directly into Ghidra, I need to wait until its analysed. If the file turns out to be packed, I'd need to run it in a debugger first to dump the payload I'm looking for. Had I done that directly, I'd be ahead of where I am with the static-first approach.
I always advise people to throw a sample into a sandbox, just so you have context as to what you are going to be looking at and into. You can also opt to not do it, its up to you. With the outsourcing of files to public sandboxes, you can use sandboxes with limited hardware at home, without the need to maintain a sandbox set-up, and without a worry in the world. Granted, your file is public, but if you are looking at a file which is public anyway, there's nothing lost.
Hope my two cents help