I rely on the latter. I am much more concerned about supply chain attacks of mass exploitation than I am about 0day in my Signal client or my browser extensions.

If there is something big enough to warrant quick update, my HN addiction will make sure I find out about it before it is a 1day.

There really isn't a great configuration for browser security rn, is there? The gold standard I think is Qubes, which afaict is not practical.