That’s definitely a factor to consider, but running binary blobs that you don’t have the source for is also a risk. It comes down to what threat vectors you think are important and what risks you’re willing to take.

It’s probably because they use busybox instead of gnu utilities so it’s not technically GNU/Linux, but yeah.

Short answer is Trisquel if you like Ubuntu/Debian, Parabola if you like Arch, and Guix if you like frustration.

The libre kernel is a bit of a pain regarding wifi and bluetooth, and depending on your graphics card the drivers aren’t going to run quite as well. You might need to get new a wireless card/usb, since there’s only a few modern chips that work with it.

There’s a list of distros on gnu.org that use the libre kernel by default, if you want to look at more options. PureOS is based on Debian focused on privacy and security. Hyperbola is based on Arch with 32 bit and BSD options.

Personally I use Guix, which is an amazing abomination with awesome features that most people don’t care about. I wouldn’t recommend it for most people unless you are coming from NixOS, know a lisp dialect, and/or are willing to put in a lot of effort.