I think it is fair as long as I make it clear (which I hope I have) that I didn't investigate fully after I saw some warning signs.
>spread doubts just because they don't get fixed in a day or two.
I am not a security expert, but tptacek is, and in 2017 he wrote that "You don't want your browser to be any number of days behind the Chromium patch cycle."[1] IIRC, tptacek or someone of similar credibility said that the browser and the kernel are the primary targets of zero-days exploits on a desktop Linux install.
[1] https://news.ycombinator.com/item?id=13517227
Also let's see how another party handles patches for Chrome: the Arch User Repository's Chrome package (not an official part of Arch Linux) "will automatically get updated as soon as the Debian package is available. This is checked at least once per hour."[2]
There are many many things a distro needs to get right to compete with, e.g., Debian or Fedora on all the criteria desktop Linux users care about. It is not easy. My thanks to Nixos's maintainers for investing their time in trying to advance the state of the art. But Linux users invest a lot of time, too, and in chiming in today I did so because I thought I could save Linux users some time by presenting my conclusions after spending many 10s of hours installing and exploring Nixos.
[2] https://aur.archlinux.org/packages/google-chrome/
>Installing your preferred version of Chrome using Nix is as simple as supplying an alternative upstream URL for the google-chrome package.
Please correct me if I am wrong: this requires building Chrome from source, which will spike the user's CPUs for hours and is impossible with less than 8 megs of RAM ("More than 16GB is highly recommended")[3]
[3] https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...