While there's no harm in using a security plugin, we don't think you need one as long as you're implementing basic security best practices because Rocket.net already includes a WAF via Cloudflare Enterprise.