Guix is a smaller distro with (presumably) less maintainers […]

Guix is not a small distro any more and has a lot of support. Yes it has more packages than Arch - but this is hardly an argument against it. It is built on different principles compared to the Arch user repository - keeping control of the own computer was always a core goal of GNU, and this logically includes security from malware.