Your logic is wrong. I agree with 1 and 2, but 3 is in direct conflict with 2.
By making all your methods virtual, you are allowing users to "hijack" them by over-riding them. Once you have "published" your class, you will not be able to maintain it anymore, as you'll have absolutely no idea how a third party user may have re-interpreted your function. At this point, changing anything in your code will potentially break your client's code, and I can guarantee you they'll hate that more than anything else.
Ignoring performance, the easiest way to write code that works is to write code that is closed and simple. Polymorphism is an open concept, and is not simple.

