It’s arch based but they just arbitrarily hold back all packages by a week for “review” (nobody actually reviews them). This means that security updates etc are delayed for no good reason. It also means that if you use the AUR, which their official package manager GUI allows you to, you will run into dependency hell and system breaking issues frequently. On top of that, regular infrastructure maintenance, like SSL cert renewals, just doesn’t get done, and it breaks everybody’s install.