@bjoern_tantau @communism That 'support for years and years' means security support. So even if the nominal versions stay stable, security fixes are backported. Security scans that only check versions usually give false positives: they think fixes in newer versions are not present when in fact they are.

Many others distros do exactly the same. I only chose Debian because the amount of software already packaged in the distro itself is bigger than any other, barring 3rd party repos.

@notTheCat there's a technique where you boot with a live system, mount your linux system, chroot into it amd change passwords. If you think this is insecure for your system, then you should considering encrypting at least your home diretory/partition.