Being able to visit a web page, open a PDF or download an inspect a git repo made by someone you don't know without the web page, PDF or git repo's being able to completely pwn the entire machine including the bootloader and the firmware for all the hardware subsystems.
Fedora at least tries relatively consistently—and has been for decades.