I am a long term Gentoo user, but honestly I feel Gentoo's security stance is pretty bad, for example https://bugs.gentoo.org/show_bug.cgi?id=597804

Their high friction contribution process with essentially requisite 'accredited developer' status is a major contributing factor.

Edit: Hah! Posting here got the bug updated within 10 minutes :)