For those curious: this is a hardened version of debian.
There feature list does not mention that explicitly, but it might also installs TOR -- their timesync software, sdwdate, requires tor to function.
Whonix is based on Kicksecure and is much more secure than Kicksecure itself since Whonix uses two VMs which run in tandem (Workstation & Gateway) so that it can mitigate rogue scripts that try to decloak you.
So the NIC is detached from the motherboard by default, and no one is permitted physical access?