Depends on what you call "rolling". To me, crux follows the rolling release model. Ports are updated when they get new releases, and not only to fix security issues. There are not "backports fixes", and the only thing that is "fixed" is the base system (coreutils and the toolchain). There are updates that "break" other packages (for example, when libpng went from 1.5 to 1.6). So yeah I think crux is more a rolling release distro.

The thing is, the base system will NEVER break in your hands due to an update, as it it only updated on "fixed releases" (3.1, 3.2, ...). In this regard, it's "semi-rolling" ;)