The model of stable Linux distros, particularly Red Hat, Debian, and Ubuntu is impressive in that they only ship cherry picked security updates, and don't ship general updates overall, often even forgoing bugfixes. They are extremely resilient against supply chain attacks.
The XZ utils backdoor, for example, did not make it into either of those three distros. That's why I hate when it's compared to programming langauge specific supply chain attacks, because there is a big different. With Debian/RHEL, you have 4+ years to catch a supply chain issue, rather than whatever your dependency cooldown is.
And then, the lack of any non-security changes means that the system behavior is stable enough to base software on it that automatically receives security updates to libraries it is using.
This is why enterprises like RHEL so much. For so many institutions, manually managing updates is a cost they are unwilling to, or straight up unable to handle. The idea of manually doing updates, or bypassing cooldowns in order to get a fix for some critical CVE, is way more expensive than it's worth at scale, especially for institutions that aren't going to actively take advantage of new features, like so many slow moving government entities or so many non tech focused corporations.
I like the model of Rust, and believe it is the future of systems programming, but I am intensely frustrated with the way it is tied to an ecosystem that is extremely sloppy about supply chain security. The Linux kernel and Firefox may use Rust, but they don't actually use the Rust ecosystem, they copy all crates they use into their own tree, and then cherry pick and review changes, or maintain the software themselves entirely. All Rust code Linux/Firefox use is owned by themselves, although I think that such a model is only possible due to the development resources they have.