The problem with ReactOS is its lack of automatic or semi-automatic OS update.

There is plan to do it, but from what I understand, it's still not available:

https://www.reactos.org/wiki/ReactOS_Update

Security is another major problem with this OS. They are proud to have produce 9M LoC, but they don't advertise how they assure this code is not full of vulnerabilities.

Do they audit the code ? Do they use static analysis tools ? Do they have specifics security practices and processes ?

I don't see any security advisory on their page. I only see a wishlist on their wiki https://www.reactos.org/wiki/Security