I definitely agree on the lockable bootloader issue being a bit overblown. If you're to a point where malware is modifying your boot partition you've already got a mountain of problems regardless.

Although one quick thing I thought I'd point out I didn't see mentioned, e/os is sometimes slow to get security updates out. Obviously it's infinitely faster than no updates if you're on hardware no longer manufacturer supported, and everything has it's pros and cons, but figured it was worth bringing up.