Your hardware is most likely not free and open source. If you use non-free hardware, it is better to have security fixes then leave it unpatched. If you are using non-free hardware it doesn't matter how free your distro is, you still must depend on hardware blackboxes. Your hardware can directly interact with your distro and do something malicious regardless of the presence of firmware blobs.

Those distros (Fefora & Debian) are fully free, but acknowledge that hardware isn't in most cases. And like responsible and reasonable developers they choose what is best for stability and security.