Tumbleweed is more cutting edge as a rolling release, but basically you're the one doing the testing. This is true for all distro's that maintain an enterprise version or a stable vs testing branch.
Wrong:
https://en.opensuse.org/Portal:TumbleweedTumbleweed is based on Factory, openSUSE's main development codebase. Tumbleweed is updated once Factory's bleeding edge software has been integrated, stabilized and tested.
With emphasis on 'experimental'. Of course, in Debian you can use backports to get your hands on newer versions, but at the risk of destabilizing the system. For this reason, on the Debian website they warn about using backports. I usually advice against it unless you know exactly what you're doing.
With emphasis on 'sid'. I mentioned experimental if you want to go nuts, but sid contains only stable and tested versions, as this is the repo that will become the next stable.
In my experience of 22 years of Linux, Manjaro stands out in stability and _tested_ updates. A main advantage is that Manjaro is not feeding a separate enterprise or stable release and they wait with their updates until they found it reasonably stable. There are not many distro's out there that provide the same service.
Like tumbleweed. Also, yes they do some testing, that said it also happens once in a while that your system will break with an update. It doesn't happen often but it happens. in the 3-4 or so years I'm now using Manjaro I completely broke my system a few times (driver and x11 updates). When you decide to use Manjaro you should expect to sometimes have to get your hands dirty when fixing some problems.
No, I did not just discover it, like I said, I've been working with Manjaro for over two years and had little issues so far. I cannot say the same of distro's that I ran for several years, except Debian stable, which I always use for dedicated servers.
I've tried many Linux systems for my PC over the past few years before I settled to Manjaro, the reason was simple, I had driver issues that i was able to fix on Manjaro pretty easiely. That said, on my server I wouldn't want to miss OpenSuse with yast. In over 5 years I didn't have a single problem on that Server.
Pacman is hard to beat as a package management system. But it is not hard to screw up a Linux system _any_ system if you don't know what you're doing.Well I wouldn't say that. In pacman the thing that stops you from breaking your system is nothing more than a yes/no question on
regular commands on for example zypper, it doesn't let you harm your system with any regular command and you need to add --force to do anything wrong with it. Sure not a big hurdle, but at least some hurdle, that stops you from doing really stupid things.
You make it sound like you're at great risk if a security patch comes a bit later. Manjaro's testing phase is not just great, it is extremely important to ensure a stable system. Like you said, "if you don't want to have broken software...".
Yes timely security patches are extremely important. These are bugfixes that in most cases don't add new functionality or break anything. They are considered safe (which is why they are shipped on release even on stable distros like debian). Delaying them for a week can be devastating.
For example let's say I'm a 1337 haxxor and I see firefox just published a security update that fixes a session hijacking bug. What do I do, I look into the FF source to see what was fixed, prepare a website that abuses the bug, e.g. to buy stuff via amazon or take over social media accounts, and make it an ad and just have to wait for out of date browsers to see that ad.
This is exactly the reason why crome and FF auto update on Windows and MacOS on each start and the user can't disable it. Having such updates delayed by a week should terrify you