Go with Bazzite. Stable or LTS distros are more insecure than rolling release, and Debian has a history of leaving vulnerable packages not updated (eg. Chromium).
Debian/Ubuntu use AppArmor for very minimal mandatory access control policies. Fedora (which Bazzite is based on) uses SELinux, which is better.