My comment wasn't clear sorry. I was thinking about privacy, not security.

What I meant is that if you use a commercial OS and browser (and your ISP too) they're still going to exfiltrate your web activity to their servers.