This is cargo-cult hardening without specifying a threat model. Some of the things in there make no sense in most contexts -- for example, logging in as root on

This is cargo-cult hardening without specifying a threat model. Some of the things in there make no sense in most contexts -- for example, logging in as root on a tty to perform administrative actions because you might have an X11 keylogger protects you from pretty much no real attack vector. Your X11 keylogger still runs as your user, with full access to your data, full access to your browser accounts and passwords, etc. Similarly, many of the L1TF-style mitigations make very little sense on a single-user computer. They make sense on shared tenancy servers / VM hosts where you want to prevent lateral movement, but there is close to no lateral movement to be had on your random Linux laptop. The mitigations that do help are mostly those at the web browser level, since this is for almost all users the only place where they run sandboxed untrusted code.