I'm gonna re-post this by @Tommy_Tran on Reddit.
This is not me, but the comment was too good not to share it again on HN.
This is from the self-post here, titled `Is Linux more private and secure than Mac OS?` https://old.reddit.com/r/privacy/comments/u6ws24/is_linux_mo...
Worth considering security when about to buy a daily-driver laptop!
-----------------
Linux is not more secure than macOS. Infact, it is not even remotely nearly as secure as macOS.
Linux for the most part lacks access control for apps. Flatpak and portal reduce some of this problem, but flatpak lacks granular control and no one is enforcing the usage of portals. As an example, controlling audio recording permission with Flatpak is a mess, as most things will just use the PulseAudio socket directly and you cannot deny them audio recording permission. You can revoke the PulseAudio socket, but that will deny both audio in and out. And this is only limited to apps which you install via Flatpak - any apps that you install via your package managers are not restricted whatsoever unless you spend hours and hours making an SELinux policy or AppArmor/Bubblewrap profile for each of them.
The X11 server on Linux is also a huge problem. Any X11 window can snoop on any other X11 window and keylog + screen record you. Nested X11 is not great for performance at all and its hard to enforce it system wide. Wayland solves this problem, but not all apps work with it yet, and XWayland windows can still snoop on each other.
None of the issues I described above exist on macOS. Unless you give an app elevated privileges, they all have to play by the rules with the permission system.
Linux also lacks the concept of verified boot or system integrity verification. In fact, most distros don't even do UEFI Secure Boot right - the verification ends at the kernel and the initrd is left unverified, unencrypted and vulnerable to evil maid attacks. There is no protection against persistent malware whatsoever too, even if you manage to protect the initrd, because there is no verification that extends to /usr, /bin, /sbin, and various other directories. macOS on the other hand has proper verified boot from the firmware to the system volume, protecting it from both evil maid attacks and persistent malware. Beyond verified boot, it also has system integrity protection, limiting what the root user can do.
There are also various miscellaneous things that macOS has such as system-wide umask setting (as opposed to just the shell), app signature verification, and so on.
Telemetry on macOS, for the mot part, is optional. Unless someone can prove otherwise (by capturing it on the network or something), any claim about invasive telemetry will not hold. Also, remember that being open source doesn't imply being trustworthy. You are still placing complete trust in whoever distributing the compiled version of your software (which will be your OS vendor most of the time if you use a traditional Linux desktop distribution) to not add nasty code in there and screw you over.
Some of Apple's apps do have mandatory telemetry or lack E2EE sync, but that is about it - you can simply not use them. One annoying aspect about macOS is that they really want you to make an apple account to do a major macOS version upgrade via the App Store (though you can still obtain the installer via their CDN if you know where to look) and that they collect hardware IDs.
In short, macOS has superior security when compared to Linux, and privacy wise it is still a great option as it has great protection against the third party software that you install. It is not great for threat models where you require anonymity, but most people don't have such threat models to begin with.
Some people will say Linux is targeted less and is therefore safer, but that is simply not true. Irrelevance != security. ReactOS is even less targeted than Linux, macOS or Windows because no one uses it, does that make it a secure operating system? And remember, malware for Linux does exist, and it's not hard to make one either. The security model is so bad that it's basically "if you execute bad code, you are screwed". There is not even a need for an OS exploit to compromise your system if the app you are running is malicious. The OS itself doesn't protect you from anything.
And before anyone jumping in accusing me of being an Apple shill - I am a Linux system administrator, and most of the systems I use daily (both on my servers and personal laptop) are Red Hat systems, not Apple ones. As much as I want to say that Linux desktop is better than macOS - that is simply not the reality, I'd be lying to you if I say so.