I'm really rooting for Asahi, but I'm not an advocate for desktop Linux. And I
love Linux.
macOS really nails as much of making a consumer-facing operating system as I feel it's possible to get right without taking something else away. XProtect, GateKeeper, SIP and the enclave just feel like the optimal combination of methods to secure the machine while not overwhelming the user.
I wish it was possible as a power user to get more information from logs in the background to ensure everything is working as it should, but Eclectic Light Company have that covered quite well (https://eclecticlight.co/downloads/ if you want to check out their tools).
It's also kind of love/hate. There's a lot of locking down that happens - some it for genuine user protection (cool), some of which is to do with market competition (the whole Epic debacle).
Sometimes they change things that shouldn't be changed and I don't know why (the Settings screen on Ventura is horrid and makes it harder to see permissions settings). Then they announce end-to-end encryption for photos and iCloud and I'm back onboard.
It's also why I don't understand the Windows 11 hate. I run it on another machine and I'm loving it as a direction for Windows - more of the security apparatus runs in the background like macOS, but the information is still available to you as a power user. Mandating TPM2 is absolutely the right call (they have workarounds for non-TPM2 machines), and being able to have cryptographic trust roots down to the boot image is a massive user-friendly feature.
I wish there was a means by which Linux could have software certification so that malicious applications could have their certificates invalidated, but I get that as the FOSS community is decentralised there's a who-watches-the-watchmen question. Having a mechanism baked in at the kernel level could be useful to solve this if it allows me as a user to "subscribe" to an authority if I choose (i.e. if I'm using Ubuntu, I could choose to use a Canonical or Google whitelist for signed apps, or none at all, sort of analogous to how the web has had multiple certificate authorities for many years, except that I could freely choose my own authority for whitelisting if I wanted to).