You've posed two totally different questions: employers using open IM clients to run business communications over, and how to keep your home network secure.
Most employers who REQUIRE users to use IM will host their own IM server on the company's LAN (usually a Jabber server) and run an in-house client, not visible from the Big I, such as a ''SameTime'' setup, or something of that ilk. Contains all the same features of AIM, but it's internal to your company's network. It's rare to find a company that authorizes, not to mention mandates, employees use a network outside of their own. It's just asking for all sorts of legal trouble.
Now, as for your second question. I can understand the dangers you are concerned about. Corporations mandate so much software be placed on their gear that you have no idea what it's doing to your network or the other machines on it. You want to make sure that you're covering all the bases when you set up your home systems. To that end, there are several things you can do to help keep your network safe:
1. Run virus scanners on everything. It almost goes without saying these days, but if it's connected to the Internet, run a virus scanner and update it daily. Heck, run two. Now, as was mentioned in the winning answer, IM clients are generally safe to run, but their software is quite bloated, the unified clients being the notable exceptions (I'm a Trillian junkie). Be wary, though, of strangers IM'ing you and asking you to ''check out their webcam by clicking this link'' or ''you've just won the lottery, click here to claim your prize.'' Chances are, you didn't win the lottery.
2. On your Fort Knox machines, run personal firewall software, even if you're behind a hardware firewall. Your work PC may be trying to communicate with your home PC's without your consent. A good software firewall (try ZoneAlarm) will alert you any time anything tries to communicate with that PC.
That's probably all you'll need to do from a base level. From here on out, we're getting into some really paranoid setups, so be warned, this is not for the faint-hearted.
3. Set up two subnets, and don't bridge them. From your hardware firewall, you could set up two networks, a 192.168.1.X network, and a 192.168.2.X network, where your work laptop would be on one subnet, and your Fort Knox machines would be on another. Your hardware firewall at 192.168.1.1 would still be the gateway for both networks, but there would be no routes from the .1 network to the .2 network, and vice versa (Now, network junkies will balk because there will be one host route from 192.168.2.X to 192.168.1.1, but I'm trying not to get lost in the weeds here). Therefore, you could logically isolate the work laptop from the other machines.
3. If you still are uneasy about subnetting, you can set up a DMZ. This solution requires TWO hardware firewalls connected in series between your ISP's connection and your Fort Knox systems. The space between the 1st and 2nd firewalls is known as the DMZ. You will connect your work laptop there. This setup will allow your work laptop to communicate freely with the Internet, but any attempts to communicate with anything beyond the second firewall will stop there. Your Fort Knox machines will be isolated from anything connected in the DMZ, but will still be able to communicate freely with the Big I. Note, though, that there may be issues with NAT and such between the two firewalls, so such a setup may be challenging.
HTH
Cheers
CJ