Tbh depending on your threat model you might be ok with just a regular os, flatpak sandboxing and an occasional vm. For example I have VMs for my dev projects, or for tools that I use seldomly but doesn’t trust like android tools. If I need I pass usb in (like if I want to flash phone with the android tools…) You will be much less limited but still have decent protection and those vms start fast. I have Fedora host with Fedora VMs and they start in like 10 seconds.