NixOS learning curve maybe is not so hard. You can start with default configurations and installed Calamares what is as simple as on other distros. Than look for options and try.
Otherwise, Flatpaks are reproducible (build with flatpak-builder as on Flathub).
I'm sick of all the attempts to whitewash the recent Red Hat move. This makes things only worse. Fedora will not be affected, Alma has a bright future, CentOS is open to all, "rebuilders", clones...
Major: Debian, Gentoo, NixOS, Arch and also FreeBSD (not GNU/Linux but still).
Other and esoteric: Void, Alpine, Solus, CRUX, Slackware, Mageia/OpenMandriva,
Corporate sponsored: Fedora, openSUSE
Sun is now Oracle anyway.
BTW there was a nice idea behind the only close button in early GNOME 3. Apps were intended to save the state on exit, so one doesn't need to minimize windows, they can close it and reopen at any time and see the exact content of a window. But GNOME completely has failed to deliver that idea.
What makes things worse, there was no clear way to keep apps on the background when the main window is closed. It was seemed as antifeature. But that was a different world where weren't so much of internet service applications running on the background 24h a day. Now there is a background portal but with quite minimal support in the DE.
Maybe it's just a general habit of mine that I keep minimum things open at time and close everything after use: desktop windows, android apps, browser tabs. So I use up to 3-5 dynamic workspaces most of the time.
I switch between apps from overview or by typing in search, or by sliding between workspaces. It is more convenient to me than classic desktops with a taskbar and minimized windows.
Always has been.
But to be fair, openSUSE was my first linux distro after Windows and YaST had been helpful to me before I learned how to use console commands. And then I switched to another distro.
I you are asking about permissions so yes. I often limit access filesystem paths, dbus proxy, devices and network.
I use flatpaks mostly. Flatpak dependencies (runtimes) are stored separately from the host system so and don't bloat my system with unwanted libraries and binaries. App data and configs are stored separately and better organized. Everything runs in sanboxes. I use overrides extensively. All these are very convenient for me.
Where can I track package versions without installing? https://packages.debian.org/trixie/ and https://packages.debian.org/unstable/ show outdated packages.
There is no god on Wayland.