Did the two stylists have a fever, respiratory symptoms or both? Were the stylists sneezing on their customers while wearing masks? I find that far fetched.

One problem in large environments is PCs trying to write infected files to shares. I found one way to address this is to flag the users writing the files. Some antivirus solutions would give you the account name trying to write the infected file to the server and even send an email to an admin. A group can be created in AD for these infected users. A GPO can be pushed out for "deny network logon" to the group. The users can be removed from the group when their PCs are marked clean. It might take some time for the user's group membership to update.

I use a RaidZ ZFS pool with 6 1TB USB drives for about 4.5 TB of total storage. The drives are plugged into a dedicated UPS. The computer on it's own UPS will power down before the drives so I have assurance all data will be committed to disk if I lost power. It was easier then getting a PC with a power supply strong enough to power the drives. My PC has 6 USB ports and gives about 50MB/s downloads. When I used a USB hub I achieved 15-20MB/s which is still good enough for video.

I haven't found this works for encrypted disks

All of the Linux solutions I have seen encode to another format. Because of lack of alternatives for ripping encrypted DVDs, my solution for years has been Windows DVD Decrypter. I just need an equivalent of DD for encrypted disks but searching only comes up with programs that re-encode. I would love to not power-on my Windows laptop for this.

I prefer lossless iso rips for several reasons. Disk space is cheap these days so why not go with lossless. ISO files work in a greater variety of players and can be burned if need be. ISO is the only format that works with Apple DVD player on my Mac Mini.