The problem is this: Linux repositories (depending on the distribution) provide software and updates, but usually that software is not the latest official version, but it's an old version or branch that has (hopefully) been patched to fix all (or maybe not all?) the vulnerabilities found so far, and I'm not sure who exactly is doing this and what delay there can be between the disclosure of a vulnerability and the availability of an update in the distribution repositories. I know this is due to a trade-off between security and stability, but I guess sometimes you might feel like having a bit more security rather than stability on a desktop installation.
So that made me wonder: should I install and update Tor using the official repository of my distribution, or should I use another method, and what method? (Like for example using the Tor official repository, which by the way warns you not to use the Ubuntu repos because their Tor package might not be up-to-date, as I suspected, and as I suspect of many other packages, hence this question). And then I asked myself the same question for Virtualbox, VLC, LibreOffice, whatever. By the way, if an application doesn't have an official repository though, it's going to be a pain to check for updates. And I know PPAs shouldn't be considered secure in general.
And that leads to the more general question: if I want a more secure and up-to-date distribution, should I sometimes consider using different methods for installations and updates in place of the official repositories of my distribution? For what kind of packages and applications would you suggest this? This question is especially about desktop installations, but if you want you can also expand your answer including servers, it might be interesting by comparison.