Bottlerocket's changelog through the storm of Linux CVEs these last year has been bad as well: https://github.com/bottlerocket-os/bottlerocket/blob/develop...

Roughly one release every 15-20 days.

Yes I was hit by waiting for Elastic Beanstalk to update nginx for the succession of fixes. Wasn't fun being pestered by my security team.