It is. Security problem in core library? Good luck waiting for 27 randos releasing an update. Whereas the distro updates it even before the issue becomes public.

I'll have to come up with some examples and write something more detailed I think to explore this.

Until NixOS I was very in favor of language specific package managers and things like flatpak.