Imo immutable distros are what’s paving the future. Personally I’m a debian fangirl, but if you want to learn something new then I’d take a look towards these, otherwise you’re essentially just configuring all the things the same ways as before, which is fine but I think we’re moving away from this.

Your laptop will be fine, although it has a Nvidia graphics card so that’s always a dice roll. You probably will have problems with brightness control and sleep mode.

For your privacy goal, honestly just using a properly configured firefox on any Linux is fine. You’re already using linux, and for the rest your browser really shouldn’t leak that much info, so it’s up to the normal avenues of blocking trackers etc.

Hardening Linux is very hard IMO.

Privacy wise, if you use free software you should generally be fine, though look into either hardening Firefox’s settings (you can use something like arkenfox user.js) or use a fork which does this for you (Librewolf or Mullvad browser).

Sandboxing solutions available to regular users (as in usable after a sane amount of effort) have some major drawbacks (which means random programs, especially proprietary ones, aren’t as safe to run as on your phone):

• They all sandbox applications which were developed and designed assuming they will run unconfined (in contrast to something like Android, where apps assume they are in a sandbox). This leads to many problems, some of which are solved by portals.
• Flatpaks are often poorly sandboxed by default, and it can be hard/impossible to properly sandbox them (for example, if your Flatpak needs access to game controllers it will likely need access to all devices to work properly).
• Firejail has a large attack surface and is an SUID binary.
• Bubblewrap has a smaller attack surface and can also use unpriviliged user namespaces instead of being an SUID binary if supported by the kernel (though this has its own security implications), but it is very hard to use (it is used by Flatpak internally).
• I don’t know much about Snaps, but I doubt they’re better than Flatpaks in this regard.

An important part of Linux security is Mandatory Access Control (implemented by SELinux and AppArmor, for example). MAC is an additional permission mechanism that is checked after the usual Unix permissions (user, group based) grant access, and is used to confine processes, so if an attacker exploits them they will only be able to access a minimal amount of information. Most distros don’t configure a MAC, and it is extremely hard and time consuming to do so (though it’s relatively easy to confine specific “high risk” processes with AppArmor if your distro has basic support for it). Fedora has SELinux configured OOTB, and allows for simple further hardening by having predefined confined SELinux users you can assign to Linux users to limit what they can do. OpenSUSE has AppArmor configured and enabled by default though it is not a full system policy AFAIK (the init process runs unconfined), in contrast to SELinux (though Fedora runs many processes and users by default unconfined too). Both have good docs (though for Fedora look at RedHat’s docs for SELinux, it goes much more in depth). From my experience, it is much easier to configure AppArmor, but it would still require an extreme amount of work to do properly, so I’d recommend sticking with a distro that does that for you.

As pointed out by @themoonisacheese, immutable distros are getting some traction recently and they are good for making a system reproductible, allowing easy rollbacks, but this should not make a big difference, privacy-wise. It also add some work for configuration / learning. Here are two levels I’m thinking of from what you presented:

• You go with any stable (big fan of Debian here too) so to avoid data breaches from brand new packages (xz…), then you can compartimentize your application with Flathub and manage the rights with Flatseal. If you go with software with less telemetry (Firefox), this should be a reasonable and easy to use setup. The rest of the privacy will depend on what is going on inside of your web browser, probably.

• The next step would be something like Qudes-OS + Tor. If your workflow / usecase allows it, this should be a good step up for privacy. Your laptop seems beefy enough to handle the many VMs, and the install is easy enough imo.

Tumbleweed is perfectly fine. You should look into linux-hardened kernel.

Although I get the idea, going all in on the privacy would mean you can never log in with a single account you have since they bind it to your ip and you’ve lost. Also using vpns all the time or tor if possible/necessary. Imo, its far too much work to go full paranoia mode.

So I‘m running debian stable with kde (dont do it on nvidia!) and pop os on a laptop. Firefox, adblock plus and pihole do most of the heavy lifting. Gaming, working and other activities on the same machine works well without vms. I do use vms in specific dev Environments though.

For kids, an immutable distro sounds like a great idea. Good luck and have a nice day.