Gentoo works best for me because I'm a control freak. It lets me tune my system in any way I want, and I don't mind leaving my computer on while I'm asleep so that it can compile its way through libreoffice, webkit, and a couple of browsers. Plus, based on complaints I hear from people using other distros, Portage beats other package managers in every way except speed.
This doesn't mean that it's best for everyone, mind you, just that it's best for me.
There are no open security bugs against TDE that I'm aware of—if there were, I'd expect them to be fixed in the next release. In my experience, the development team, while not huge, is active and competent.
I've been using TDE since a little while after Gentoo sunsetted KDE3, and I've had no issues. Just make sure your X server is secure—-nolisten and all that stuff—and don't try to use Konqueror as a web browser (it remains an excellent file manager), and you should be fine.
Wayland is "more secure" than X in that it makes less LAN contact by default and tries to sandbox programs from one another to an extent, just in case some future browser exploit that can copy random swathes of your screen tries to screenshot your password manager or something. There are no active exploits against a correctly-configured X server at this time that will magically vanish if you switch to Wayland, as far as I'm aware—it's more future-proofing stuff.
Running a couple of Pis with Gentoo myself right now. It works as well as anything, although unless you're very patient you'll want to set up a binary package host (or distcc or something) to take the load off the Pi's somewhat anemic processor.
One thing to keep in mind about older versions of the nvidia proprietary drivers is that they will only work with specific kernel versions (and specific X versions—not sure about Wayland). Once the driver series your card needs stops being updated, you can't update your kernel without patching the driver. Assuming you have the skills to patch the driver, or someone who does makes their patches public.
I went through this song-and-dance with a very old laptop that had a card of the NV40 generation as its only GPU (no integrated graphics). Eventually I did install nouveau on it, and used it for several years without any issues.
Trinity Desktop Environment, forked from KDE3.
TDE has this natively under the advanced window settings, so I would expect KDE to have it too.
Or ditch udisks in favour of pmount (or udevil?), which shouldn't be affected as far as I can tell. That will get you a few months' grace before a similar problem pops up there.
Based on what I've seen, for a DE to gain much traction, you need at least one well-known medium-large distro putting it as a default on some of their install media—MATE is well-represented these days because Mint backed it at a crucial stage in its development. I don't think Enlightenment ever had that.
Is there a modern equivalent of that? Basically turn it into a thin client?
Well, X is still out there with its thin client capabilities intact. There are Wayland-compatible VNC clients and servers, if one isn't big on X. SPICE is intended for connecting to VMs as servers. RDP if you want to use a Windows box as a server.
For a machine such as the OP describes, it would also be possible to install a tailored distro and software selection into the onboard space and place /home and such on a network drive, although that makes it impossible to take the tablet out of range of the LAN. If the touchscreen doesn't work under either the Wacom or libinput drivers, it would probably be a waste of time, though.
(Really, 16GB is plenty for the distro itself—if I remove the three kernel source trees, a couple of games, and some FreePascal stuff, my desktop system minus /home would fit in that, and it's anything but minimalistic.)
Yeah, that's how I was taught in school in Canada in the 1980s, although no one ever explained why. It always did seem odd.
It matters, because it's a tool. That means it can be used correctly or incorrectly . . . and most people who don't understand a given tool end up using it incorrectly, and in doing so, damage themselves, the tool, and/or innocent bystanders.
True AI ("general artificial intelligence", if you prefer) would qualify as a person in its own right, rather than a tool, and therefore be able to take responsibility for its own actions. LLMs can't do that, so the responsibility for anything done by these types of model lies with either the person using it (or requiring its use) or whoever advertised the LLM as fit for some purpose. And that's VERY important, from a legal, cultural, and societal point of view.
-nolistenis an actual option passed to the X server—your distro may do so by default—to work around a known security issue in some versions. I admit I'd have to look up the details, as it's been a couple of years since that issue was reported. Recent X versions almost certainly have a patch.