There is a bit of explanation in this thread
Thence, it depends on your level of worry - to be worry-free you would have to run the OS from SSD or USB.
The general design is that you shouldn’t need to. At least for things that get ran by default.
OK. Thank you all for your help and answers. I think this topic can be closed. Hope it will help to others as well.