I would argue it’s harder to get a root exploit on Silverblue because more of the filesystem is less mutable and applications are more sandboxed.

I’m running NixOS because declarative is saving me time on system changes nad keeping multiple workstations synced up.

SB is more well protected against unauthorized system changes, Nix is more flexible while still providing good rollbacks.