If your hardware supports linux-libre and you don't consume DRM content (If you don't know. Widevine is the cause), it's better to use that. If not, then you can use Debian/LMDE which can only use the blobs your hardware requires.
My only reason for wanting to stay with the stock kernel is because its better maintained and gets audited more
linux-libre used by Trisquel GNU+Linux which used by FSF. So don't worry.
Can the blobs from the stock kernel be a vulnerbility?
This is not the thing to worry about. Vulnerability is normal because we are human. What is worrying is that blobs are non-libre and you are dependent on the blob developer to care. If the blob developer cares, then great. If not, then you are done. Also, this is a matter of trust. We cannot know what blobs are doing because they are non-libre.