my old stash is on legacy
i have a few other features on my node i added myself so i just do "watch only" for the old stash thus not importing private, but importing public address just as a balance display

but if it was time to spend them. then yes i treat it as a hot wallet meaning get a (offline) new set of keypair. to use only public address as change address. and then spend old private key i import to the new public address(change) i import. and then wipe drive. and redo it all again.

its a hassle to spend old stash but that hassle is avoided by making it another reason to not wanna spend old stash