> Who wants to be patching the OS? Who wants to be dealing with package vulnerabilities?

Choose OpenBSD (and don't install stupid stuff like bash) and you won't have to deal with any of that.