Not a single mention of secure boot? Weird.
I would say you are already secure enough if you are using software from official/trusted repositories and updating them on a regular basis.
That said, if you want extra security. Drop all software that cannot run on Wayland and go even further by isolating all desktop applications with the Flatpak sandbox. This is made extremely easy with Flatseal. Maximum points if you setup secure boot.
It appears to be possible https://flathub.org/apps/com.protonvpn.www