The quantitative data we have shows that NixOS is fresher than other distros in general by a significant margin.

See https://repology.org/repositories/graphs

If you pick a specific random package update, nixpkgs often has that update months to years before other distros.

If you pick a specific CVE, nixpkgs usually is better with the exception of embargoed ones, where Ubuntu, Fedora, etc get to prepare their patched packages ahead of time.

> They build the whole OS in CI

As opposed to only building a part of the OS?