That sounds pretty good. Passwordless sudo and disabling SELinux are the first things I do on new Fedora installs. If somebody can compromise my user account,

That sounds pretty good. Passwordless sudo and disabling SELinux are the first things I do on new Fedora installs. If somebody can compromise my user account, compromising root is pointless and trivial. More so on Qubes OS, where only breaking out of the VM really matters. SELinux isn't usable in a strict mode because it's config is so ungainly that devs rarely create profiles. So only the opt-in mode is common and that's pretty pointless. Especially compared to using containers.