I also wonder about Nix and Guix. But I never seriously consider Gentoo.
Are those really important thing I should have configured? The only safety thing I have is LUKS encription.
Ubuntu configures AppArmor by default, Fedora sets up SELinux, openSUSE also sets up SELinux to some extent—most major distributions except Arch do it, because you’re installing it yourself. I recommend looking into it. AppArmor and SELinux are essentially about preventing privilege escalation. Here’s a good place to start: wiki.archlinux.org/title/Apparmor
SELinux is an absolute pain to understand and setup, so it’s good that Fedora does it.