So may be the developer needs to do a point release, which has clear patches to fix the security issues, give a nudge to downstream. The newer practice of bundling in feature enhancesments with bug fixes; has made package maintainers life more difficult.

Overal, most ppl I know who liked Debian, ran SID, so they go the desktop updates. Probably a Debian stable machine ought, be run like a server with the minimum surface area and avoid dektop stuff.