If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix and Qubes) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification when a system update fixes a vulnerability. secureblue.dev/features www.kicksecure.com/#security