I think that I have the browser well covered - uBlock in hard mode, Decentraleyes plus firefox in strict privacy and cleaning all of the data after closing it. Plus the tabs run in container tabs.

The router is configured to use cloud flare so that covers the dns for me.

For daily operations I only need KeePassXC libreoffice, Thunderbird and Gimp and I'm golden. I'm also considering antiX Linux as a no systemD alternative to Devuan.