Yes and he should do that on a VM not connected to the internet with a 100mbit connection. A VPS needs to be secured, to not become part of a botnet or send spam. What do you think where all the spam in your Inbox or your blog comes from?