IMHO, ZEN is the magic sauce of Qubes. IIRC, there are users running Hardened Gentoo, and GrapheneOS on Qubes - either would dramatically increase security over standard distributions. This would require a lot of technical expertise on the part of the user.
It's been a year since I worked with Windows.
My QOS Thinkpad is growing old (as am I), and I'm now inclined toward replacing my QOS Thinkpad and GOS P6P with a GOS P10PXL (to be frequently used in desktop mode) or a GOS P10PFOLD.
With this setup, I would keep my data and processing NOT on the phone, but "hidden" in the cloud as much as practical (so that if the phone is snatched, or border-crossing-confiscated from me, there is no info to be recovered.)
(If GOS offers a GOS phone, I'll plan on getting that to support GOS.)