Most Linux distributions have to make a compromise between performance, easy of use, security, and more. In the end, you will have to do tuning, and that includes tuning for performance and security.

As one of the developers of Lynis, I can suggest picking up a auditors mindset. So just use the distribution you like the most, then become good in evaluating what can be improved. As you already discovered, automation is the key. A tool like Lynis will simplify that greatly: https://cisofy.com/lynis/

Happy hardening :)