That's highly dependent on circumstance, and not usually the case. How many remote 0-days were patched in Linux recently? How many local privilege escalations?

That's highly dependent on circumstance, and not usually the case. How many remote 0-days were patched in Linux recently? How many local privilege escalations? How many of those subsystems can already be totally removed for a known workload? At the pointy end, you can be more bleeding edge compiling your own vs. waiting for distro releases. In the "I care enough to break from the crowd and own my own infrastructure" class of situation, this is not unheard of.