Just listing some things that I needed to do for working remotely on a personal device: have an antivirus installed, make sure Windows firewall is enabled, enable automatic updates, screensaver or lockscreen configured for 15 minutes of inactivity, and use a strong password (and a good password manager).

However, you can configure GRUB to use an encrypted boot partition, and even have detached encryption headers. It does take a bit more work, and you should make sure you know what you are doing. (e.g. losing a detached header basically means your data is all lost)

https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#Encrypted_boot_partition_(GRUB)