Are there any FOSS OS with macOS-level security?

macOS have superior security compared to standard Linux/BSD distributions even at the software level, separate from their hardware lockdown.

Are there any FOSS desktop OS with equivalent security, including proper verified boot and exploit mitigations? If not, why?

Yes, Fedora Silverblue would be my recommendation for something balancing security but being mainstream enough.

If you want more mainstream you could go with vanilla Fedora or some spins if you are opinionated about your desktop environment.

If you want more security you can look at things like QubesOS.

> macOS have superior security compared to standard Linux/BSD distributions even at the software level

What evidence do you have to state that claim?

> including proper verified boot and exploit mitigations? If not, why?

Any operating system with TPM and Secure Boot support has this, Windows, Linux, and FreeBSD is in the planning stages for Secure Boot.

It sounds like you're unaware of the available security features that have been available for a significant amount of time on x86.

There is a huge gap between what's available for Linux (ie the Android and ChromeOS boot systems), and what the mainstream Linux distributions actually implement.

On the whole, the distros do a terrible job. If you can modify the initrd (which you can on all of them by default), it's game over.

And that's just secure boot. Linux has no real equivalent to TCC, for example.

Fedora Silverblue's Secure Boot is also primarily for UEFI support and not fundamentally designed to create a boot chain or detect attacks on the OS. Additionally, it has weaknesses in kernel protection mechanisms (insufficient kernel module loading restrictions), inadequate system call protection, and incomplete memory protection mechanisms. While its immutable design is notable, the detection and defense mechanisms against base system attacks are inadequate, with limited security verification of the rpm-ostree system itself.

Linux distributions' exploit mitigation features include basic ASLR, DEP, and RELRO, but their implementations are incomplete. Advanced protection features like those found in macOS (such as PAC, Pointer Authentication, strict stack protection, and JIT spray attack prevention) are either not implemented by default or are limited in scope.

Resolving these issues would require an enormous investment of time and cost to apply parameters and patches, and these solutions are not available by default.

While QubesOS's approach is interesting, it lacks Secure Boot, and its security relies on sandboxing through OS isolation via the Xen hypervisor, while the operating systems within still contain the aforementioned issues (though running a macOS-level secure OS in QubesOS might be a solution).