In my personal opinion, privacy-oriented distributions are more likely to be targeted by intelligence agencies, I prefer a mainstream debloated version at least that way you have the advantage of not attracting attention among so many millions of users. trusting your OpSec in the good will of someone it's not a good idea, at least for me.