In my experience, Redhat's security updates are slower than Canonical's most of the time.
I don't necessarily equate "slower" with "bad" when it comes to any patches. My speculation is that Redhat may more thoroughly test security updates.
Exactly, I’ve found RedHat (and CentOS)‘s security patching for be very well tested and packages are often provided with far more sane and safer defaults than say Ubuntu. Additionally SELinux with RHEL/CentOS has excellent coverage and tooling, if you want to harden your servers it’s a good platform.
yep -- Centos [which distro I favor for servers] is verrry slow with patches, upgrades, and other additions -- but it is 100% rock solid with no surprises. I use other distros for desktop and various uses, but for servers, I stick with CentOS for stability [or Debian, if CentOS not available]
Meaningfully better than other distributions?
Meaningfully longer. Ubuntu/Debian will demand you update the whole distribution sooner than Red Hat. And there's not a lot of people insane enough to upgrade full OS on a train, x-ray machine, radiation treatment machine, powerplant control system or particle accelerator every two or three years. Especially if software running on them is proprietary and wasn't certified for new set of dependencies.
Exactly. The FDA is willing to dance around security updates but updating the OS completely triggers all sorts of expensive reviews and testing.
Stable updates are nice in general. If you're looking for a distro with old software with bare updates then use RHEL. If you're looking for a modern distro with frequent stable updates then use Arch.