The contra is that “stable” releases are now a liability, because it takes longer for upstream fixes to be back-ported. Recently, for bugs that are quickly exploitable in the wild.

A recent example is the TCP options use-after-free, where it took Canonical a couple days to patch LTS beyond when the fix was first available in Fedora 45.

And these are just for public CVEs. I’m also worried that there are a lot of quiet fixes being made with new agentic review tooling, which may fix an undiscovered bug but will never be back-ported.

Damned if you, damned if you don't. Update constantly and you might get a fun little surprise shipped to you in one of the updates. Update occasionally and you'll miss the critical fix(es) to a vulnerability you have.

I think the only way out is extreme scrutiny of all updates and paranoid minimization of all attack vectors, but the industry is only going to settle into that local minimum after we go through some devastating breaches.

Yea I should have put it in my first post, but that is the one I have come across a lot reading some of the package maintainers comments from fedora on reddit. It's a really good point. Thanks!