I'd recommend GNU Guix System, in that all the software is free (so any vulnerabilities can be fixed) and applications can always be updated, as previous versions can be safely reverted to; any system with btrfs has a similar advantage to the latter, although not as great.