Linux

Depends on your risk model. Almost all VPNs have a linux client available, most installers can setup whole disk encryption, and they even support secureboot. There's also antivirus that detect malicious software that target all OSs.

Linux is also far more private and secure than Windows. If you felt safe torrenting on Windows you were misled.

First off you don't want to be downloading things off the internet. Linux systems are build with packages so you install the packages you need. Flatpaks are also packages but they are sandboxed and often are much newer versions. You can install flatpaks as a local user or system wide.

As far a security goes, securing Linux is actually a pretty complex topic. You could start by turning on the Firewall as on Linux Mint there is even a GUI for that.

For serious security you want to setup mandatory access controls (MAC). This is a really complex topic but you might be able to use defaults. Basically what MAC does is it restricts apps to only have the access they absolutely need.

Just two cents on "downloading". System setup and programs are basically all from your distro's package manager with sometimes a couple of things from GitHub if you have particular needs.

For the rest of stuff (media / files / more) there is no windows defender and I don't personally try to chase down antivirus. You can totally get malicious stuff out there so maybe don't click pop ups and download everything the pirate bay has to offer, but security is more baked into the Linux permission structure and user space. Find a guide and do it "the Linux way" if you decide you need to go set up deluge or transmission with a private tracker to get some Linux ISOs for personal use.

Some people do a lot of sweating over the security of the system, but I would generally say if you need that... you'll know it. Sure a VPN is a good idea (I don't use one for anything), good permissions are important (I don't play the immutable OS game), and encryption may have a place for you (or maybe not, not everyone needs a luks filesystem system encrypted at rest); but you're making a setup that you can use / prefer to use. Make your own call, basically anything on the beaten track is safe enough and sane enough.

Bazzite is just Kinoite with gaming things out of the box. Which in turn is just Fedora with KDE Plasma but atomic and immutable. It doesn't get any more general purpose than that. Bazzite even preinstalls a lot of stuff that Fedora users have to add manually, like proprietary drivers. If you don't want a gaming centric OS, then there's also Aurora which is the workstation version. I guess my point is that, there's not an objectively best choice in Linux. Something we often tend to forget is that personal taste also plays a role. I personally used Mint for 5 years and supported the project monetarily. But my tastes changed and I think atomic and immutable is a good path for adoption, since it all works more or less the way people have come to expect smartphones to work. But, with the power and flexibility of x86-64 computing. It perfectly fits the management model of set it up once and forget about it. Specially since OP is specifically mentioning his interest on having a system focused on security. A system that is working just works, no doubts, buts or ifs, it always works and if anything happens that make it not work anymore, you just rollback to a working state immediately without fuzz, it is a pretty neat feature.