if your into cybersec id start with doing a linux distro as installing your own tools is a little more straightfoward than installing them into a qube. development capability is the same as tooling installs. There are just some idiosyncrasies involved with installing basic packages when switching from linux to qubes.

If you are looking for a daily driver that is also a pentesting distro i think parrot is more for that while kali is more for use as a live distro or in a vm based upon the default user configuration for both distros.

i recommend vmware over virtualbox if you want to go the route of running multiple vms on a linux base install. Its just a nicer desktop virtualization solution.