Definitely agree, particularly when it comes to security.
Valve takes a snapshot of Arch repos, frozen in time. They then spend months developing on top of this version. And by the time it's released, it's multiple months out of date. They don't pull in security updates; Arch is a rolling release, they don't backport fixes like Debian or Fedora does.
Sorry, I should note that 26.3 is not released yet. This is a "snapshot", aka a development build. The full version of 26.3 will be released in a couple of months.
I updated the title to reflect that 26.3 is not released yet.