Seonding the security point. It’s probably riskier to use bleeding edge distros because the “old” Debian packages are well cured and don’t have a lot of new issues. And as you said also old packages get security updates. Even in debian.

Been running Debian on my server for 10+ years.

Vanilla OS seems promising. Just released a new version too.

Aren’t the just rebranding some generic ones that they vetted for compatibility? I heard that somewhere, so take it with a grain of salt.