Fedora is fine, you may want to use secureblue or just plain Fedora Atomic/ ublue as Base.
But generally using as many flatpaks as possible and least system packages, and managing filesystem permissions like the guy on Fedora Discuss, this should totally fit your needs.
QubesOS is cool but it tries to solve the problem of insecure software through extreme compartimentalization which is hard to use and extreme on the hardware.