I’ve been wanting to post almost this identical question. I’ve been on Ubuntu lts for a few years, and Fedora before that. I’m constantly back and forth in my head on running more up to date -> less known CVEs, or older, more tested code that has less chance of a malicious commit slipping slipping through.

Tools wise, I keep a very minimal desktop and virtualize anything I need. Or, occasionally I’ll use an old desktop/laptop to host something if I need bare metal.