Qubes is probably the best option but, the last time I checked, it didn't have certain deniability features that someone with the feds in their threat model might prefer.

Personally I'd say use Qubes because it might be better at preventing you from getting raided in the first place.

Decisions decisions.

That's what hackers do in popular stories, right? In reality, most cybercriminsls just don't care that much (they usually use Tor browser, though). I mean they mostly use discord and telegram (both unencrypted).

Serious "hackers" are usually state sponsored now, or members of mature groups.

They don't care, I would say they don't know.

I saw an article where they analyzed the leaked IP addresses from a breach forum, and some of the top ten were Surfshark and iCloud Private relay.

>and some of the top ten were Surfshark and iCloud Private relay.

what's wrong with icloud private relay? It uses a 2-hop architecture so it's probably more private than any single-hop VPN.

It's good, but it's funny to think about cybercriminals running Safari and an iCloud+ Apple account.