I think that a combination of what you're already doing and living a few releases behind the latest is about as safe as we should hope for on our personal machines.
There was a good blog post a few months ago on further hardening NixOS: https://christine.website/blog/paranoid-nixos-2021-07-18
How is this solved?
It feels so many security ideas fail to protect the /home dir which contains 99% of important data that needs secured, and instead focus on the OS. I understand that for servers and hypervisors, but it feels like so little effort goes into desktop OS on this.
Basically, desktop OSes need to become more like iOS and Android in how they ask for permissions and segregate apps from each other.
Note: I like that it does that and would like this capability to be expanded and refined.
Eg a warning/prompt if a program tries to read/modify/delete more than x files in your home directory (not including its own config files). This would stop an entire class of malware scanning for passwords or secrets in your home folder. It could even if implemented right stop some of the ransomware attacks after a few files.
It seems crazy that so little effort is put into this kind of thing vs the crazy level of effort that goes into hardening the OS.
But considering immutable OS increases overall security of the system and that the system/software likely has to be compramised first to tamper /home/* I think they're useful to prevent this attack as well.
[1] https://needgap.com/problems/188-proving-computer-hack-proof... (Disclosure: I run this problem validation forum).
What really helps is application sandboxing, e.g. with firejail.
There's a lot more that could be done to advance the security aspect of Linux. Flatpak is an improvement as it requires applications to declare the permissions they need, however it still has a ways to go. I wish there was a tool to monitor if some random process is accessing folder X or has high network usage, a'la Little Snitch on Mac. Linux desktop doesn't have a ton of manpower behind it though, so it all takes time.
Is there anything immutable like that on the Debian side?
Half a year ago it looks like there wasn't anythinghttps://www.reddit.com/r/Ubuntu/comments/lbyo9o/is_there_any...
There are other approaches, e.g. Guix and NixOS as mentioned by others, but you also can get most of Silverblue's benefits from BTRFS/ZFS and a package manager that can create snapshots. Not sure if apt integrates like that.
For me, Silverblue just enforces good defaults: the base OS is as simple as needed and I only install necessary applications through Flatpak, which has some security benefits over direct package installations. VMs are for more involved work with potentially risky software (i.e. development environments with random NPM dependencies).
Physics informs us a perfectly secure system is impossible.
We need to socially accept it rather than make ourselves paranoid.
Qubes got it right in its philosophy. We either get system secured by correctness or by isolation. The former is not possible on a Linux developer machine.
It's not entirely safe, but I think gets me 90% of the way to a reasonably safe workspace. If there is malware in a VM, I can nuke it and reset affected credentials in my main OS (which is not infected). It's not too much extra overhead, I just SSH into the VM and work as usual. I've used Qubes before and have also tried a fully Docker-based workflow (developing exclusively in containers), but there can be too many headaches with either.