Definitely agree, particularly when it comes to security.

Valve takes a snapshot of Arch repos, frozen in time. They then spend months developing on top of this version. And by the time it's released, it's multiple months out of date. They don't pull in security updates; Arch is a rolling release, they don't backport fixes like Debian or Fedora does.