I'll note that I've been developing software for GNU/Linux systems and managing production networks for about 30 years now. A lot of my work is security related... After the XZ utils attack, I wrote a debugger that examined a running process to look for signs of namespace tampering like the exploit involved in that attack. I've done a lot of SRE work, including very large networks including Google.

Most professionals that I know... most people with an infosec background and most people with lots of production network management experience, take for granted that regular release systems are more secure than LTS systems, and more importantly I think we take for granted that everyone KNOWS that. And on the latter point I think we're wrong. People don't know that, even though they should.

If you want secure software, then you want software that's actively maintained by its developers. That much should be obvious. Most developers maintain their software for around a year, so releases like Fedora are much easier to secure... Fedora can simply ship the bug fixes directly from the upstream projects. LTS systems might do the same thing for the first 6-12 months of their maintenance window. But beyond that point, the distribution's work gets real, REAL hard. Once upstream maintenance ends, they have to backport and test code on their own, and they're doing that with FAR fewer maintainers than the total of all of the developers upstream. It's not a trivial difference either. There are more security flaws published than distributions are capable of backporting on their own. They have to prioritize and triage. A lot of lower priority flaws don't make the cut and never get fixed.

And, actually, a lot of high severity flaws don't get fixed if they're in low priority packages. And that's a thing that's often overlooked. Very important though.

LTS systems will have more unpatched security vulnerabilities than regular release distributions. They'll have more vulnerabilities discovered during the maintenance window of any given release. They'll be the furthest behind on deploying security improvements and hardening. No matter how you measure it, LTS systems always lose against regular release systems from a security perspective, because THAT'S NOT WHAT LTS SYSTEMS ARE FOR.

LTS systems exist to provide better compatibility with the ecosystem of software that existed at approximately the same time as the LTS release. That's their purpose. That's the thing they do better than regular release systems. They're definitely better at that. But not at security.