>>998585 (OP)
Security over everything.
Capability-based permissions.
ASLR errywhere
Sandboxing out the ass
NX
DEP
Mandatory access control enabled by default (see: Linux kernel security modules)
Package manager
Good license and community-centered open source development
No scope creep -- if a module only does one thing, it won't have 10 other features added in a new update
Modularity a la minix so that you don't have to increase your attack surface unnecessarily by having lots of Built-in things that you'll never need
Effective logging and monitoring tools built-in
Secure by default, not putting the onus on the user
Good documentation
No sideloading allowed -- an OS is only as secure as the software installed on it
Good firewall ACEs by default
No SSH, no ability to create reverse shells, such as on linux with bash and /dev/tcp/
Built-in engine for malware and hacking IOCs that combines software updates with security scans
Heuristic analysis and basically the OS treating every process and file as a potential attack vector that needs to be monitored and kept in check
Windows UAC-esque thing for networking (sort of like UAC + macOS LittleSnitch)
Easy way to monitor network traffic, like a built-in Wireshark, but made more user-friendly for dummies
Forced disk encryption
TOTP multi-factor authentication even for local logins, including su/sudo (or whatever the equivalent will be called in this OS)
gnu coreutils/moreutils but redesigned with security as the highest priority
Written in security-focused languages like Rust as opposed to C/C++
Shell prevents user from using harmful/destructive/insecure commands (something like a reverse shell or bind shell or sudo rm -rf / --no-preserve-root would simply not be allowed to run)
Walled garden approach as opposed to "muh freedums"
None of the fragmentation problems of Linux, where there are zillions of distros and tons of devices that never receive updates
LTS type releases where the only updates are security updates, and feature updates are only rolled out every now and then
Only supports non-harmful hardware
Features and performance are secondary to security. If a new cool feature adds security problems, it won't be added to the OS.