> Is it? Just update everything regularly.
On stable production systems? Never.
The CIP project https://www.cip-project.org/ aims to backport security fixes to Linux for *25* years after each CIP release.
No sensible organization runs bleeding edge OSes on their airplanes, power plants, payment processors, industrial plants...