You can still use optical media (CD/DVD) or USB keys to install packages with APT, so I don’t see how Slackware would have any advantage over Debian there.
There’s even a apt-offline[0] to create a list of ‘needed’ packages on one system, then download these packages on another one and transport them to the air-gapped system. Of course, you will still have to decide whether to trust these downloaded packages, and unless you trust at least some Debian Developers to do the right thing, this will be hard to do even with GPG signatures on all packages.
Slackware is generally more secure by default, such as explicitly requiring root (not sudo) for package management and at least sudo for utilities that prompt the kernel. This is much in the vein of the *BSDs.
Also its conservative nature, constant security advisories and eschewing of bleeding edge are a bonus.
$ dpkg-query -W -f '${Status}\n' sudo
unknown ok not-installed
IOW, it is perfectly possible not to use (or even install sudo) on Debian. I don’t want to argue whether Debian or Slackware have a more ‘conservative nature’ nor whether that’s an advantage, but there are of course also security advisories for Debian (e.g. today for the systemd packages…).
> at least sudo for utilities that prompt the kernel
Basically everything ‘prompts the kernel’ in one way or another, could you expand on how exactly Slackware manages to run when every syscall needs sudo? (Or what you mean by ‘prompt the kernel’.)
I guess at the end of the day, you can configure a Debian installation to be more secure than any given Slackware installation and you can configure a Slackware installation to be more secure than any given Debian installation – this, of course, depends on your skills and experience with any of the two, so you should use with whatever you’re more comfortable :)
There’s even a apt-offline[0] to create a list of ‘needed’ packages on one system, then download these packages on another one and transport them to the air-gapped system. Of course, you will still have to decide whether to trust these downloaded packages, and unless you trust at least some Debian Developers to do the right thing, this will be hard to do even with GPG signatures on all packages.
[0] http://packages.debian.org/wheezy/apt-offline