Big hint: Anything that involves SSH - or command-line - is a non-starter.
Only for people who don't know how to use a command line.
Linux anything is not for mortals, not even Ubuntu or similar desktop distros. I run a Linux Laptop for some ham radio & SDR stuff. It's not for normal people.
My mom used Linux, right up until she was 91 years old and had to move into a memory care facility. She liked it much better than Windows, and had far fewer problems with it than Windows.
"Headless" anything is a non-starter for normal people.
I disagree there. Give them an icon on their desktop that starts up a graphical remote access agent and 99 out of 100 times they will prefer that to walking over to the remote compute to access it locally (provided you're not on a super slow network).
It needs to be a drive/folder that is recognized by Windows or Mac.
That would be a silly plan for people that don't use Windows exclusively. No need to pick the lowest common denominator if you don't have to. Windows is actually extraordinarily complex, the only people who don't realize this are the people who don't know anything else besides Windows. Being used to a thing does not mean that the thing is better than other things. It only means that you are used to it, thus more familiar. I do agree however, that if you know nothing more than Windows, you should use Windows. It kind of goes without saying that you will be lost elsewhere.
Never have all your data "on-site" anywhere
I agree with this. Unfortunately, this usually means "use the cloud" for most people, as they do not have the knowledge/experience to set up their own remote backups. But similarly, don't depend on a backup in the cloud as your only backup either. And for sure, don't consider it secure. You can encrypt it yourself to help rectify that, but then we're getting back to a concept that users that are totally dependent on third parties (cloud services) for their computing needs would not be able to implement on their own. So for the generic computer user who can't set up their own remote backups, they need to accept that most likely other people will be able to see whatever they backup to the cloud.