Lol @ 'mainstream distros' or as I like to call them Freedesktop/Linux, or as I've recently taking to calling them Freedesktop+Linux.

These systems do not exist to be well built and secure, they exist to be familiar for Windows users. You're running a system with polkit, PulseAudio, DBus, glibc, no grsec, PAM, systemd but suddenly OpenSSL is your security concern? These systems have time and time again introduced absurd nightmares from a security perspective in order to be familiar to Windows users. (lol @ polkit and udisks)

Use an actual system if you care about sane design. The only one of those warts I am sadly forced to use is glibc mostly because it's needed for nvidia drivers. Has nothing to do with security though, it just turns out I like to not constantly have to fight with my system when yet another invasive background daemon randomly changes something and I have to trace it and fix it because 'oh my god, users are too stupid to make their own choice'.

Which is ultimately what it all comes down to, knowledge. You cannot be 'secure' without it. These systems attempt to make some feeble attempt at security without the user being required to know what she's doing, that will never happen.

Any system that tries to market itself to people switching from Windows, avoid it like the plague and send death threats to the developers, instead, install a proper system that is built for people who know, understand, and like Unix and choose Unix for another reason than. 'Hurr durr, Microsoft is spying on me, I need something else, but I don't know what, let's go to r/linux and let them recommend me something.'