That might be possible for browser vulns/home menu vulns, They come up all the time. But NOT for vulns which could give kernel access. After 9.3 update, where Nintendo didn't patch memchunkhax properly, I don't think they are gonna make the same mistake again.
OOT3DHax can give only homebrew access, but you will have to start oot everytime you want homebrew. But in CFW, with the correct cia files, you can have homebrew as well as games which you have not purchased directly in your home menu.
And also there is no reason to update to the next firmware version unless you wanna go online/ have a super duper stable system, so stable that it can be home to ninety nine trillion trillion trillion trillion horses.