A friend's website was recently hacked. (An outsourced project manager wasn't diligent in applying Wordpress security updates.)
An unfortunate effect of the hacking is that ISP's are now flagging emails sent from his company as spam.
To prevent the same thing happening in the future (emails getting recognized as spam as a result of a hacking), he is considering separating out the domain for his company's presence from the domain used in his company's email addresses.
Does this seem like a sound strategy?
Or is this overkill - and as long as appropriate plug-ins (e.g., https://ithemes.com/security/) and periodic updates are applied, he shouldn't worry about similar problems in the future?