It's good in theory but in practice you'd need to spend a lot of time and money doing deep audits yourself, both hardware and software. That just really isn't a worthwhile investment for the vast, vast, majority of people.

At the end of the day it all still boils down to trust based on reputation, incentives and oversight. Openness is important but no panacea.

User experience and usability.

How many distros are shipping with ASLR now? Last I knew there were still major distros that weren't.

Heck, do the common DEs sandbox their search indexing processes yet, given there's been various vulnerabilities there previously?

Yes, okay, you have control, but when nobody implements relatively basic defence-in-depth mitigations that have been available on Windows (especially) and macOS for over a decade it's just sad and undermines the argument that its security is better.

It's not that you shouldn't trust it, it's that you could from security perspective easily shoot yourself in the foot.

Does anyone know of a distro that focuses on usability and privacy"? Subgraph is still in alpha...