or set a system with opensuse + openZFS with limited updates (no kernel or ZFS updates, only safety ones)
Linux kernel is a monster of over 50 millions lines of code (LOC). Rule of thumb: 1 security hole in 1000 lines of code (LOC). Enough space for many many security holes in Linux kernel.
https://www.heise.de/en/news/Linux-Criticism-reasons-and-consequences-of-the-CVE-flood-in-the-kernel-9963850.html
All enterprise linux distributions receive monthly linux kernel security updates.
Check with (Open-)SCAP for missing security updates (checkSecurity.sh):
https://forums.opensuse.org/t/measures-to-harden-an-opensuse-install-and-to-run-an-opensuse-system-securely/180953/17