How to Automatically Decrypt LUKS on Boot Without Compromising Security?

I personally use Clevis and Tang, which allows me to bypass entering my passphrase when I'm at home. But when I’m out and about, I have to enter it every single time. It's a nice balance, although I wouldn't recommend it for laptops that aren't always connected to a network. For those, the other options might work better.

TPM worked out fine for me, but you should note that certain third-party at-boot kernel modules won’t work. I did this setup on my laptop running Ubuntu. Also, typing a lengthy password takes just a few seconds, but I totally get the hassle if your machine reboots and you're not there.

TPM with Linux can be challenging. My go-to solution is to keep the key file on a USB drive—it's like a poor man's Yubikey. Alternatively, you could just use an actual Yubikey. For me, I prefer typing my password every time, though.

Decrypting your disk at boot without entering a passphrase does undermine the need for encryption in the first place. It kind of defeats its purpose.

Using a combination of TPM and secure boot could mirror the Bitlocker experience. Another option is to use a Yubikey. Have you checked out resources on setting up TPM? There's a post here that might help you out.