The standard, 'serious' Linux paradigm can give a false sense of security, as well as being quite frustrating at times, with its denial of access (whose computer?). It therefore becomes necessary to run many applications as 'root', even whilst connected to the www. Incidentally, I have used a 'live' Puppy to tear apart a Debian-based install that I had made deliberately 'over-secure'. I have also done the same with KolibriOS ('Hummingbird OS'), which is written in ~100% ASM, & doesn't recognise the alleged 'defences'. As an example, on an external storage medium, formatted to ext4, the 'lost & found' folder is locked to most Linuxen, but not to a Puppy.
In any case (AFAIK) the most vulnerable potential attack/contamination vector/application, the web-browser, usually does not run as 'root'. For security, there are private browsing mode, https, and of course, firewalls, and web-browser firewalls (on top), not to forget the mighty BleachBit cleaner.
Regarding the lack of updates, in my experience, MSW is constantly updated/patched, yet is apparently the least secure system of all; rolling-release Linuxen, with their constant patching, break within about a week or so; LTS Linuxen with relatively few updates, 'just work'; so the relative lack of updates in Puppy (depending on the version) may be a false area of concern, one that seriously bothered me until I found out a bit more.
An important security feature of Puppy is that (in a 'frugal' installation, which is preferred/recommended) each session can be either saved or not, to either a standard or unique file, so it's possible to run 'bespoke' sessions for specific purposes, requiring logout/login to return to 'normal' use. Restricted user accounts can also be added, for specific purposes. Given that a frugal install is effectively a 'live' system, Puppy may actually be more secure than 'normal' Linuxen, if used correctly.
Finally, never join a forum that demands registration, always use a 'ghost' email address.