There is no clear policy for this. But it is good to put CiviCRM behind a firewall/VPN. That way you can only access civicrm if your ip address is allowed. For connecting external websites/application you can then use CiviProxy.
This way CiviCRM and your data are secure, no matter whether your CiviCRM installation has securty issues.
My personal advice is ...
I have not tried this but https://lab.civicrm.org/extensions/configitems says
The extension can import the following types of items:
OptionGroups with OptionValues
CustomGroups with CustomFields
CiviCRM Settings (...