That's what I was taught to do by my dad. Take the uncompiled kernel, remove every driver and feature from it that you don't use for your use-case and then comp

That's what I was taught to do by my dad. Take the uncompiled kernel, remove every driver and feature from it that you don't use for your use-case and then compile. Then go through hardening steps at each layer, chroot all the things, tripwire, etc. Compile all applications configuring for only the features you're going to use. Get a report on all versions and subscribe to vulnerability mailing lists. And then at the end, understand that you have a system that is still vulnerable so set up a regular cadence of maintenance. It's a bit harder to do these days for various reasons.