> There are so many plugins, connectors, protocols, and often the old neglected ones turn into attack vectors.

Practically speaking this is probably true but theoretically a distribution's job should be to somehow guarantee that a specific package built their way gets the security fixes for the way they built it.

This is anyway tangential to the fact that in security "less is more".