Both good points. In practice a) hasn't been an issue but for b) we had to apply a fair amount of patches ourselves.

Luckily b is almost fixed, and if combined with e.g. grsecurity I think nix has a good story.