I'd argue they'd have to answer (or at least think about) what their goldilocks is in terms of the following axis:
- No defaults^[That is, being required to set everything up by yourself.] <--:--|--:--> Highly opinionated^[That is, simply enjoy what someone else has decided for you.]
- Convenience <--:--|--:--> Security
- Rolling release <--:--|--:--> Frozen packages/repository
- Means to an end^[That is, Linux/OS/distro itself ain't that interesting; I just need it for XYZ.] <--:--|--:--> End in itself^[That is, I want to engage with Linux/OS/distro itself.]
OP, FYI: GPU passthrough isn't riskless (OpSec-wise), unfortunately. This Hacker News thread contains pointers if you'd wish to read up on that.