It really depends on what you're doing. But yes, if you want to develop in "The NPM Style" where you suck down tiny things to do little pieces of what you need (and those things suck down tiny things, ad infinitum) then you're naturally exposed to the security risks inherent with depending on an unaudited soup of tiny things.

You don't get secure things for free, you have to pay for that by doing things like "import and audit software yourself" or even "write simple utilities from scratch" on occasion.

That's when you join debian :)

I've spent thirty, mostly on stable, and there's been minimal pain. Several orders of magnitude less than on any other system.

(That might hint that I'm not doing trendy things.)