District41 So if I were to run a linux distro on bare metal compromising my system would be trivial with physical access to the device.
It would be trivial without disk encryption, and straightforward with disk encryption, even with Secure Boot. The situation isn't great on Windows either; there are many side channels available on the desktop, including firmware attacks and hardware keyloggers. On Linux, you can at least fully secure the bootloader if you have a Unified Kernel Image with Secure Boot and measured boot; that would make your bootloader tamper evident and likely stronger than Windows for boot security.
District41 Should I just ditch the idea of a x86x64 device all together and just get a macbook?
This is certainly an option. MacBooks have integration between the hardware and the OS, allowing the more aggressive implementation of modern security features, and your apps will be sandboxed by default, unless you install unsandboxed ones. They have a Secure Boot implementation that is stronger than Microsoft's (in Full Security Mode) because it doesn't rely on having an excessively broad range of signed third-party firmware and OSes.
District41 Also how come chromeos managed to lock itself down by building from a gentoo build?
Chrome OS improves the security of Linux in a few ways. For starters, it does not have a GNU userland, but instead uses Chrome as its interface. This allows several advantages, including the broad application of PartitionAlloc, a more secure memory allocator reminiscent of hardened_malloc on GrapheneOS. Similar to mobile devices, Chrome OS has a full hardware-backed Verified Boot implementation, so a compromise of any system component is detected, and the Chromebook will revert to a known-good state if that occurs. The system doesn't allow unsigned native code to be loaded, so there are very few attack vectors for malware persistence. The most common attack vectors on Chrome OS that remain are phishing and the user installing malicious extensions.
District41 Is it just that all the great security based software engineers decline to release anything that they're not being paid for and so everything that gets released on linux is just a second rate mimicry of the real thing?
Actually, Chromium OS is fully open source. Any other distro that wants to copy security features from Chrome OS can do so (with the exception of proprietary features like ARCVM, their Android emulator). The issue is that most Linux distributions rely on a GNU userland, most users expect to be able to modify their system (antithetical to Verified Boot), and they need to be able to support native and legacy applications. Note that progress is being made with UKIs and fs-verity on Silverblue, as well as work on Flatpak to increase the usage of sandboxed apps, but there is still much work to be done.