archbtw You can lock it down. Or make compromise not matter much. Or both.
Since you already bought the hardware and your comfortable with arch, you could just go with it. Make two steam accounts, a buyer and a player. The player account goes on the pc, the buyer your trusted device to gift games to your player. For some bundles and deals, you'll have to gift account credit and buy them as the player. Keep financial or any other sensitive info off the pc and treat it as potentially compromised. If anything happens, or you think anything might have happened, all you have to do is reinstall linux and steam.
Anything you can run in a vm, such as web browsers, discord, music streaming etc, should be. Your router may be able to isolate the pc from the rest of your network.
If you want it more appliance like, theres some atomic variants of arch like blendos. Theres also Bazzite, an atomic Fedora variant made for gaming and includes Steam. All you have to do is install and log in.
This setup assumes you have a trusted device, which you said you'll get later. You don't need much for said trusted device. You could do a fresh install on one of those old servers, buy your pc some games, tell steam not to keep your cc number (who knows if it listens), and then wipe the device and just keep your pass and 2fa safe.