Agreed, though I think privacy strictness that disallows certificate checking might just skip MacOS entirely.

Privacy defaults on Apple systems are generally good — at least most potential risks are opt-in rather than opt-out, which the majority of vendors prefer — but without lockdown engaged MacOS has a lot of I/O that might not pass the strictest audits.

Even without the privacy concerns, I think it removes the sovereignty of your own computer.

I decide what code I run on my computer.

A few years ago I had some peripheral that started ~~iTunes~~ Music.app every time I plugged it in. (Bluetooth headphones, I think). As I don't use it, and there was no way to disable it I figured i could just delete it.

Nope! Music.app is a system application on a read-only partition shadowed on your root filesystem. Apparently it is possible by booting with the partition in read-write developer mode, but you'll get to do it all over again with every update.