On the security questions I know it would be unpopular but I'd suggest running Arch or an Arch based distro. If your packages are all quite close to the head of development then there are not as many known exploitable bugs and any adversary will probably have to resort to zerodays, which is risky and expensive for them.

The fear of Arch breakng all the time is actually unfounded. It might have been true long ago, but it hasn't been my experience.