I decided on NixOS.
The defaults start out locked down. The firewall has only port 22 open, so give your root user a decent password, and immediately set up your user with a public/private key, test it works then turn off root login via ssh and password logins.
NixOS also only installs what you configure, and remove what you don't, so if you like utils that are considered standard, like 'which', be sure to include them in your configuration.
With NixOS I feel like I know exactly what's on my system at any given time, and nothing should be there that I didn't put there by declaring I want it there.
I have my system set up to update daily so it gets security fixes immediately.
I also have a reproducible system built on a functional build tool called Nix. I can replicate the system easily. If I want lockfile level reproducibility (like rust or npm), I can use flakes.
Are there other distributions more focused solely on optimizing security? Maybe, but the core NixOS development are extremely security conscious and I trust them more than any other group of core distribution group.