Agreed, though I think privacy strictness that disallows certificate checking might just skip MacOS entirely.
Privacy defaults on Apple systems are generally good — at least most potential risks are opt-in rather than opt-out, which the majority of vendors prefer — but without lockdown engaged MacOS has a lot of I/O that might not pass the strictest audits.
Even without the privacy concerns, I think it removes the sovereignty of your own computer.
I decide what code I run on my computer.
A few years ago I had some peripheral that started iTunes Music.app every time I plugged it in. (Bluetooth headphones, I think). As I don't use it, and there was no way to disable it I figured i could just delete it.
Nope! Music.app is a system application on a read-only partition shadowed on your root filesystem. Apparently it is possible by booting with the partition in read-write developer mode, but you'll get to do it all over again with every update.