wuseman MacOS having no hardware virtualization for literally anything at all
macOS does support hardware virtualization, so I’m not sure what you mean. https://developer.apple.com/documentation/hypervisor
wuseman compared to Qubes OS that runs little everything in an isolated VM
This sounds ideal, but its security model isn’t impenetrable.
The Qubes OS project itself admits that:
The size of the current TCB is on the order of hundreds of thousands of lines of C code
Although this is much smaller than other OSes, this means the Xen hypervisor is still ultimately a massive, memory-unsafe program running at the highest privilege level. There is plenty of complex emulation and VM management code sitting there ready to be exploited. In a Qubes OS news article, Joanna Rutkowska herself plainly states that relying on a hypervisor as a single point of failure is itself a security problem. Given the history of Xen vulnerabilities affecting Qubes, other defense-in-depth measures are needed.
Qubes OS still lacks basic boot security on par with other x86 desktop OSes. Even on machines supporting Qubes AEM, and even if it does begin to support UEFI Secure Boot with UKIs, it will still be far behind macOS which has a (albeit imperfect) verified boot implementation that is capable of mitigating OS-level malware persistence after a compromise. The same cannot be said for a traditional UEFI Secure Boot implementation.
Due to the lack of boot security, Qubes OS relies on dom0 never being compromised at any point. Given the state of Xen, as well as qrexec, which, as a result of being written in memory-unsafe code, has had severe memory vulnerabilities, a user with a threat model that potentially involves advanced persistent threats (APTs) cannot assume this won’t happen.
Qubes OS relies on the user to have the technical capacity and the discipline to properly separate apps across domains. Most users have, and the default VM templates encourage, a setup where the user invents trust domains, e.g., “Personal”, “Work”, “Vault”. This is inherently a security issue. Any Qube containing several apps, especially if that includes a browser, has a massive attack surface comparable to a monolithic desktop. Given passwordless root and the lack of Wayland support within guests, these domains are in certain ways more vulnerable than a monolithic Linux OS would have been.
Meanwhile, the macOS security model is almost entirely transparent to the user, and doesn't require the same kind of discipline and the invention of arbitrary trust domains. Sandboxing of apps from the store occurs automatically. Progress has been made to improve memory safety from the kernel down to the apps themselves.
In my opinion, neither Qubes OS nor macOS are suitable options for high-value users who may face APTs, but Qubes OS is not all around more secure. It has several security disadvantages compared to other options and lacks important defense-in-depth security features.