[bluGill]

You need to automatically update from a trusted source. That source better audit and update constantly. Which is hard.

[LtWorf]

Stable distributions have security teams.