Now that Linux is in charge of issuing all its own CVEs, the latest version of the LTS kernel gets the fixes for all known bugs as soon as they become available. Thus, by tracking the LTS kernel tree and issuing a rolling Linux release immediately, you can be certain that your Chainguard OS is as secure as humanly possible.
Oh, and it's immutable. Pretty cool