Honestly the biggest things are don’t run shit as root and don’t expose port 22. Especially don’t run things you downloaded from some website as root but in general just don’t run things as root. That’ll handle most problems that are likely to arise.

It’s very easy, a lot of these huge platforms are just corporate adware and military/intelligence propaganda machines, creating something real with real people will blow it out of the water.

It’s fundamentally unenforceable, even if they tried to do what they’ve done to phones and not allow other OS’s to be installed, you could still get development boxes, embedded boxes, etc that by nature of being what they are could not have locked boot loaders.