> There are so many plugins, connectors, protocols, and often the old neglected ones turn into attack vectors. Practically speaking this is probably true but t

> There are so many plugins, connectors, protocols, and often the old neglected ones turn into attack vectors. Practically speaking this is probably true but theoretically a distribution's job should be to somehow guarantee that a specific package built their way gets the security fixes for the way they built it. This is anyway tangential to the fact that in security "less is more".