> There are so many plugins, connectors, protocols, and often the old neglected ones turn into attack vectors.
Practically speaking this is probably true but theoretically a distribution's job should be to somehow guarantee that a specific package built their way gets the security fixes for the way they built it.
This is anyway tangential to the fact that in security "less is more".
That's one of the most compelling cases I've heard for running something like Gentoo in prod.
There are so many plugins, connectors, protocols, and often the old neglected ones turn into attack vectors.