How to secure a Linux node running satoshi 0.16.1? Everyone in the BTC space seems to suggest that running a full node is the way to go. But Linux has a huge attack surface and I don't want to lose my BTC by having my wallet on an insecure OS. What is everybody else doing? Version 0.16.1 doesn't support HW wallets, so are people really keeping their BTC in an actual satoshi (bitcoin-core) wallet? Or using HW wallets, and the node is just for overall network security (and bragging rights)?
As a quick answer, some wallets allow you to specify a node that they will connect to. You can run your own node, and point your wallet at it. Beyond being trustless, this has an added bonus of increasing your financial privacy, especially if your node is connected to the tor network. 

Note that many such wallets are ‘light wallet’ mobile applications, but I would trust a mobile wallet over a desktop full node wallet myself. This offers a good solution of maintaining sovereignty for a day-to-day use wallet in my opinion. 

For larger amounts, using a HW wallet or other cold storage mechanism is highly recommended!