>"Has Mint improved sec-wise?"
Yes, markedly.
They basically follow the latest Ubuntu LTS closely, and I get the latest Firefox etc. a couple of days after the official release.
I'm still considering KDE Neon, but that's mostly a personal preference for KDE.
I've now been running KDE Neon on my laptop (X220) for a little while, and I highly recommend trying it out. It's literally Ubuntu LTS with an almost rolling-release KDE repo, and a bit of extra polish here and there.
It has been even more "it just works" than Mint, which is already stupendously easy to install.
I remember that they used to "achieve" stability by not updating (apt pinning) important packages like kernel, xorg etc and did strange stuff like copying deb packages from ubuntu/debian verbatim into their repos.
Edit: I wouldnt touch Mint with a 10ft pole. Seems like they still have no sec advisaries, still ship a remix of debian/ubuntu packages and so on:
2013:
https://web.archive.org/web/20140214063150/https://lists.ubu...
2016:
https://lwn.net/Articles/676664/