depends on workload. Debian has very old packages and can be insecure but it is a set it and forget it type of thing, it is good when uptime is critical for a server. For desktops, or servers that need better security, but can tolerate a little downtime, rolling releases are good too, if you are enough to update frequently, and you should, since updates usually contain a lot of patched vulrenabilities