Linux

Setups like Android or those new fancy ummutable distros don't actually make anything more secure. If the underlying OS is drectly exploited they don't protect you. Not having a mechanism included to get you root permissions regularly, doesn't help you against exploits achieving the same in unplanned ways. In fact -allthough that's a minor issue- you can probably specifically target the latter distros even after a patch: After all we are talking about direct changes to binary code here. On that level you could get ideas about manipulating the overlay to access the unpatched files.

In the end the most effective way to be more secure is not a mass produced thing like Android that locks out everyone (and not even being that good at it because there are masses working to circumvent it to get control over their device back), but to minimise you attack surface: Don't have stuff activated you don't need. Have a kernel compiled for your device with only exactly the components you really need. Or whitelist all kernel modules you need and nothing more. Explicitly declare what a user can do and access actively (see: SELinux, AppArmor with strict policies) instead of relying on the underlying passive permission system.