Haha, well it's not only X11, but it's one of the main reasons. Other reasons are that for my usage and work, it just "works", no hours of configuration in dotfiles. Also it's convenient as a cross platform developer, since I can just crosscompile to Linux and Windows(mingw) via Docker. However, without the Mac, you'll have to break some licenses with a hackintosh. I think the project is cool, but in work related situations I can't do that because of legal reasons.
And then again when their site gets subverted and you have to reinstall since you might have a rootkitted binary. I loved Mint for its incredible usability. Just can't recommend a supplier whose security was that bad.
Nah. You can't hold a 'maintainer transgression' which happened two years ago against them forever.
They have indeed implemented solid checks and offer a Shaxxx-sum file for every iso file they publish. Not only that, bt publicly "soul searched" and went to great lenghts to assure the community and its users that such mistakes would not be repeated. Now verifying the authenticity of the iso file actively encouraged, on the download page.
They made a mistake, took solid steps to improve, and the show has moved on. You should too, instead of smearing the project far far down the line. (I'm being retorical, I know)
The project's security sucked across the board. They didn't care or know how to do it. One hacker here even appeared to hack them in mid-discussion and post database credentials that showed they were using defaults. They then implemented a mitigation after bad press and soul searching. The thing I'm doing isn't smearing the project: it's letting people know not to trust its security without 3rd party verification (esp pen tests). That's because (a) it's a sane default for any project and (b) this one failed hard on the basics at least once.
So, I advise caution until I see a 3rd party evaluation showing their security is good now. You apparently followed them carefully. Did any security professionals look at their site/db/whatever after the fixes and give independent confirmation? That's all I'd need to stop reminding people of this.
The graphical user interface has almost nothing to do with ease of configuration. And yes, ease of configuration is worth a lot.
Related anecdote: I started a friend of mine on Ubuntu, but she hated all the configuration via endless clicking. She immediately took to Archlinux---there's still configuration, but it's simpler and since it's all text, it's much easier to just read everything on the Archwiki instead of having to follow pictures (or descriptions of pictures).
This also reminds me about a cool project I've found, but not had time to test yet; https://github.com/shinh/maloader