It’s strong, but splitting services into separate VMs is stronger than just using separate docker containers. This is especially true for the torrent client.

I’m not a netsec professional, this is just my understanding of best practices.