Being a "rolling release" has absolutely nothing to do with it. They still need to update their repositories and add patches to it.
No, the size of its dev team does not necessarily mean that they are behind with patching security issues. it depends on the commitment and skills of devs, and the community.
Sure - a one-man-band supported distro could do all that. But a larger distro with a dedicated security team will definitely do it better.