> Security from websites, installable software, physical access?

All those would be important, but don't let the perfect be the enemy of the good. We could start from the Vulnerability Of The Year: supply chain attacks.

Being able to visit a web page, open a PDF or download and inspect a git repo without the web page, PDF or git repo's being able to completely pwn the entire machine including the bootloader and the firmware for all the hardware subsystems.

Desktop Linux is very bad at that compared to ChromeOS and MacOS, but some distros are much better than others. For a few decades now, Fedora has been one of the better ones.