As a consumer I would expect Jolla to make me want to use Sailfish, then boot anything else from custom kernels to Linux forks.
But Sailfish + decent recovery first.

Has the security vacancy been filled in yet?

One of the software engineers on this forum might take the position to work at the root of evil and prevent it to consume itsself?

You are the person we are looking for, if you…

can prevent Jolla devices from being infected with rootkits
have practical experience in finding and fixing such problems
have the ability to document level of confidence in a component
can focus on improving, not complaining
have work experience in the security area
are a team player with can do -attitude
have good communication skills in English
are independent-minded, innovative and proactive in your work