AFAIK Kali is not as simple as Debian + some pentest apps and fancy graphics, but also has laxer firewall and security permissions to make sure all pentest apps will run properly, meaning you yourself are now vulnerable when running it, which is why it's normally run in a VM during engagements, and not something that you daily drive and host personal information on, like SSH keys or browser cookies.

No, there are quite large differences and thus kali itself actively advises against doing that.