What your colleague is referring to is something that was considered an acceptable practice a very long time ago. That is no longer the case (and I'd argue it was of dubious value 15 years ago, even). Because the forest (not the domain) is where your security boundary lies, you get very limited additional security out of this setup (if any), for which you add complexity and have to deal with child domains, which Microsoft no longer recommends using, except for a very limited number of cases (cruise ships being the remaining example of an organization where child domains make sense).
Your colleague is wrong, and you should not do this. Instead, you should do it right, and consider smacking him upside the head for suggesting an implementation that might have had some small value 15 years ago, with the original version of Active Directory. As to how to do it right and harden Active Directory properly, you haven't provided enough information to make any well-informed recommendations, except to say that your colleague's proposal is not a good idea. (Personally, I would ignore any further suggestions from someone who suggested an empty forest root. People who know what they're talking about regarding Active Directory wouldn't suggest such a thing in the first place.)