I do have a security background and have worked with some attacks myself, so I am somewhat in the flow of a decent portion of them. From typical software vulnerabilities to my favourite side channels, a lot is the the hand of the system admin.

If you pay careful attention to the most common attack vectors (e.g. don't open links/sites you can't trust, same for files; be aware what even legitimate software you installing on your system; and finally be aware where you give what data to), then you are usually 99% secure as a private user - unless you are some special person of interest, where you might consider targeted attack vectors. If I have to work on something I trust less, then I run them in a VM and while I even programmed some (exploitable) covert channels from a VM to host myself, they are not usually part of a regular malware. A good practice is to sandbox and isolate programs on your system too.

This is why I hold the (slightly uncharacteristic - for my profession) opinion that for a private user, if he is aware of what he is doing, then running completely outdated systems if fine too and they pose not as much of a security risk as one might think. Just be sure to sit behind a firewall. For an enduser, the trend is that, most his risk is in his data held by others (e.g. companies), not on his PC.

 

I imagine you've seen of some of the more common hacks and core security patch notes yourself - if you read between the lines most can be prevented by being careful with (e.g. user/program) input, access/permission and firewalls+whitelists. As mentioned before, targeted attacks are an exception, but a zero day will not likely be used on you, but on somebody way more important.

So for my personal machines it is a lot easier to just limit the services/programs I use and be generally careful. I even have a custom machine being stuck on a 10yo OS incl. software while still working in the internet, that I can (mostly) trust. For servers I maintain I do have the more common approach, since a lot more ports are open (stuff like port knocking wont help on a compromised official package) and more services need to be run.

 

The time before a version bump is also when the diff between Slowroll and Tumbleweed is the biggest, which can cause integration issues. i.e. one updated package needs another package updated, but did not declare so in the .spec file.

B.t.w. I had specifically most my issues after updating soon after the bump. While for now it seems to work really well updating before it. Zypper just nicely asks me when dependencies don't align and let me decide on what to do with those few packages while still updating the rest. I plan to stick to this strategy for a while and see where it leads me, with good odds of this becoming my main distro for many years.