> It’s just a matter of figuring out which manner has the better value to risk trade off This is also bad. If you want to have both stability/reliability and

> It’s just a matter of figuring out which manner has the better value to risk trade off This is also bad. If you want to have both stability/reliability and also receive security updates you need somebody to track security issues and selectively backport patches. This is what some Linux distribution do. Mainly Debian, Ubuntu, paid versions of SuSE and Red Had and so on