Most malware doesn't target the kernel directly, so I don't think it will change anything, especially if Linux used with seccomp like in Android. For people who really cares about privacy proprietary OS with preinstalled spyware already is a nightmare.
I think the best way is using live debian image with Wayland cage. User can change something, but it will be lost on restart. Debian supports plymouth out-of-the-box if enabled in grub.
In this guide author dumped edid from disaplay and then loaded it without any modifications. So after reloading edid you can choose any resolution? Or I understood something wrong?
User sddm also cannot execute poweroff (it is ok) but if I press shutdown button in sddm it will poweroff (not ok).
If I press shut down in KDE Plasma I will get black screen and no sddm (I can restart it with systemctl restart sddm from tty and it will work again)
How can I fix this bugs?
No, this is not possible. Virt-manager is just a GUI over libvirt. For now libvirt doesn't support USB passthrought by port id, only by device id (which changes on each plug) or vendor id.