At this point I just point people to Silverblue or a variant. It's got SELinux, flatpaks, atomic updates and corporate sponsorship. I'm not so wild about Redhat these days, but Silverblue is honestly probably the best from the standpoint of being secure, stable, robust, generally well put-together out of the box, and very difficult for a noob to screw up. I don't love saying this, but it's true.