TPM has solved this now for more than a decade.

Verified boot + TPM encryption key storage is a huge layer of protection for the boot process.

Check out the Arch wiki for TPM. It has some good reading.

https://wiki.archlinux.org/title/Trusted_Platform_Module

Just use AI to remove all the AI slop!

During those rare times that you boot into Windows 11, go ahead and update it.

I wouldn’t go out of your way and boot into it for the sole purpose of keeping it updated tho.