Nothing prevents you from running the latest kernel. The kernel build scripts can even generate .deb and .rpm directly so it coexists nicely with the package manager, though even that isn't strictly necessary.
My only complaint is that I wished it went back 2 LTS releases. For example, the current project I'm working on settled on 20.04 and there are no more new hwe kernels being released for it despite the rest of the userland receiving updates.
https://madaidans-insecurities.github.io/guides/linux-harden...
That depends entirely on how well your state serializes to disk and restores. If nothing else, I occasionally make the mistake of getting a setup going that would just be a pain to recreate in terms of getting everything open again (too many windows open in a specific arrangement).
We went with the latter because our minimal attack surface made it unlikely that we'd need to backport many fixes, but it was always looming.