Linux is only as secure as you make it.

ShaniOS maintains two separate environments. If an update - or anything - goes wrong with one environment, simply reboot and switch to the other.