As long as you are using the default green distros (should be 2)
We would all be in the same boat.
Assuming their developers are going through security audits, a splash of signature checks, perhaps some scans on the cache, constantly checking for vulnerabilities and whatnot we should be looking decent in regards to security compared to say even windows that is being super hardened and maintained.
Functionality may be a smidgen different. I am assuming that because of the Luks issue I am experiencing (and what appears to be others), this may not be the case. I am sure these are simple things that they will update us on and are working on solutions . Appears to be a relatively small team to handle tons of requests so patience and whatnot are always the right thing to do.
The odds of an attacker not only installing a special certificate into your browser then, being psychic that you would check the md5 hash on a particular website to change the code on the page after pointing you to it instead of you simply using a hash utility is rather unlikely. usually you get STDs from clicking on links from forums, emails, installing software, evil maids, compromised routers(default login/password), basic social engineering scams, using the OS your computer came with, falling victim to clicking the add which have super attractive folks in your area that know you are the one so they want to webcam you or having child porn on your device. You know the basics As far as telemetry/adds and backdoors I think we all fall victim to, so the best you can do is not make it easier by encrypting your drives, burner images, tons of fake accounts, a pay as you go phone bought by someone else that maybe has snake on it and finding a generator that adds tons of fake web traffic to the devices that you obviously use and tag you for various algorithms.