Security-wise it will depend on the distro. Under Gnome /KDE it will be flatpak responsible for sandboxing. So it doesn't depend (too much) on Purism. On the hardware side they put way more effort (at the price of perf maybe ?) than other manufacturer to avoid backdoors.