Debian stable. If you need something to be on the bleeding edge install it from backports or build from source. But keep most of your system boring and stable. It has worked fine for me for years.
As long as you do regulary updates of your debian stable, you are not secured against supply chain attacks.
As long as you do regulary updates of your debian stable, you are not secured against supply chain attacks.