A staging server isn't a C&C server. Anyone who's ever broken into sites as a teenager or done pentesting for their career understands the concept: it's a shell on a server unrelated to you or your business, which you can log into from anywhere, and on which all your tools are built.

You typically don't run your exploits from your own machine, both because you don't want a single network hop between you and your target, and because your tools may be inconvenient to run on your own machine.