Ubuntu is based on Debian - so your best bet would be switching to Debian.
I've used it for some time - it's quite good distribution. It has a lot of features that make it nice desktop os(although now we're going into opinions land).
Let's adress each point separately:
1. Debian has security upgrades and branches.
You get your programs from so-called repositories - these are some remote servers containing your programs. You can have multiple repositories available. Debian has three main branches/streams - stable, testing, and unstable.
Stable(currently called "Jessie") is preferred for servers, discouraged for desktops - packages tend to be old, but are really stable and don't break often(if at all).
Testing(currently called "stretch") is newer branch, which contains packages that have been in unstable for a while. Considered almost stable. After some time, this becomes new stable branch.
Unstable(called "Sid") is where newest packages go - this theoretically means that it should break once in a while, but practically I've never experienced anything going wrong - I've used it for about a year. I consider this relatively safe.
Moreover there is separate security repository, with security updates from Debian development team - plus security bugfixes tend to go through, regardless of branch.
If you're concerned about security, read this FAQ. Please note that not all bugs are making you vulnerable(although it's not a good practice to have bugs in your code).
2. When do you get new OS?
On Debian, you get three separate choices.
Stable and Testing means that you get software updates(although not automatic; you need to update yourself, or set some script/program to do remind you about updating), but system updates aren't automatic too(although if you refer to branches by identifier, not name, using
apt-get dist-upgrade will upgrade your system). Please note that they are rare - Ubuntu has fixed development cycle - Debian doesn't. They provide new stable release once in 2-3 years, but this is it. No need though, since testing has already pretty new packages.
Unstable is whole different story - it's so called rolling release - meaning you have one system, and no versions - whenever you update your packages, you're on the "latest OS version". You don't have Debian Sid 1.0, 2.0, etc. like you do with Ubuntu. Just update and continue working.
3. CentOS needs additional codex?
This one might be true - there are several codecs that are patented and need you to accept licences/download properiarity software(e.g. mp3). CentOS doesn't provide these codes out of the box, so you need to install them yourself - however, these shouldn't be too hard.
I'm not familiar with CentOS - only had access to servers, never installed or used as my distribution of choice - but note that CentOS is based on RedHat and aims to be enterprise quality server distro - and while this is completely fine to use server distribution for your desktop, you might want to consider using something that's created for desktop users.