That’s why a suitable middle-of-the-road approach seems to be statically compiling one’s kernel with the least amount of add-ons (drivers - that’s what most of the kernel is anyway) possible. I see it as a decent idea but annoying in practice since bigger updates mean either a script/manual intervention every time, and I like Debian so you can see how I perceive that.