I was just wondering about what Canonical does for its Ubuntu users to protect or benefit them. I'm referring to the distribution itself. For example, the root account is disabled. Or the use of AppArmor to protect certain applications by default. Another one is the HWE kernel track which allows the LTS versions to be used on newer hardware but upon an upgrade switches to the Generic track for stability.

Anything else that I haven't thought about or am unaware of?