How well does pkgsrc do with security updates? This is one area where quarterly releases scare me compared with more of a rolling build, as many packages will need patching before a quarter is up.
Pkgsrc have this vulnerability database to check against packages also -Current gets updated often