Actually Debian's rolling release is newer than Arch, 5.3.1:
Edit: Actually it looks like the versions are just named differently. Debian uses SVN version from 20151205, while Arch uses 20160209. So Arch is more fresh (by 2 months), but uses different naming convention.
Ack on the version stuff.
Testing doesn't always get security fixes in a timely manner.
Read more at: https://www.debian.org/security/faq#testing
Testing is where the next stable (currently Stretch) is being worked out.
Except for when it freezes.