Re: Warning : Sample NOT representative
Hmm. Let me see.
Firewall: check (built in functionality, default setting)
uBlock, Ghostery and Incognito: check
Patched: check (although I feel left out - Windows people get a lot more of that)
Filevault enabled: check (built in functionality)
Backup encrypted: check (built in functionality)
USB sticks encrypted: check (built in functionality)
Bootup password to stop booting from other media: check.
Prevent loading of plugged in bootroms: patched, check
Media soldered in so impossible to reformat after theft: check
Not permitting unsigned code: check (default setting)
Display showing owner details & reward offer on bootup: check
The only thing that is slightly outside standard is that I use Viscosity VPN, VeraCrypt for portable archives and Vivaldi to confuse the crap out of websites I don't trust, and I use macports to pull in stuff such as nmap. Still, a basic macbook comes with all the tools to bolt the doors firmly shut. There is a way to secure Windows machines as well, but that is both more involved and more costly, so if security is your thing I think Windows is not exactly the best starting point.
As for "not needing any user intervention": if you set upgrades to auto it is indeed pretty OK, also because it defaults to blocking unsigned code.