I've been on something of a roll setting up Raspberry Pi's as something of a family IoT cloud.
While it's probably not (yet) completely secure from hackers like the NSA, I do have a lot of confidence in Debian/Raspbian linux. With 7 million RPi's sold and lots of volunteers working on it, I expect it will be getting security updates for a long time.
I've got nice simple Python fabric scripts that I run from my laptop to keep everything up-to-date, setup ssh keys, firewalls, knockd, motion webcams, temperature and humidity sensors and private MQTT brokers and loggers.
Its not all foolproof yet -- but I'm learning a lot, and expect to open source it.