Famously, Snowden used Qubes and wasn’t caught by the NSA, so it is possible to achieve a reasonable (not perfect) security with this OS.
So where are the known cases when such an exploit was used?
See also this.
Also, the topic here is digital sovereignty in software, not a complete, perfect digital sovereignty. Please don’t go off-topic.