I actually love this, but I just disabled sudo completely (as in it exists, bcs it exists in debian-13-minimal, but there is no password / its unusable). However you can just press windows + alt + shift + ENTER on any window and get a root shell 
Any enduser who will want a root shell can learn that keybind imho
https://forum.qubes-os.org/t/fortifying-sys-net-a-shift-to-openbsd/
If it were for me the whole setup would be OpenBSD templates, but those don’t support qvm-bla and alike, and I need an icon to show up in the tray for the wifi + password. So that I can’t do.
Remember: endusers need to be able to just use it intuitively.
Thats nifty, but not enduser. They can use whonix / tor.
kernel stuff
I’m leaving kernel stuff to the Qubes team, because I don’t want to do support for that Absolute stability is super important (which is why I’m also hesitant on that audio Qube).
Endusers also don’t know what a kernel is
hardening
I will try switching all my debian-13-minimal’s to kicksecure soon. If that works nicely, I might go with this.
But this is a per-kuhb thing, so if for example alpine (didnt try it yet) fully supports all the Qubes bells and whistles (qvm-bla) you can just roll your own kuhb and publish a repo on github for your custom kuhb’s with stuff like “my fancy app in an alpine template”.
It doesnt work for OpenBSD, which is SO UTTERLY SAD!!! because it doesnt support qvm-copy, qvm-run and alike, which is what kuhbs makes heavy use of to get things done.