A bit scary but I understand ubuntu probably don't have the resource to watch all those packages all the time for verifying/backporting/testing etc.
As far as security goes, Ubuntu really should work together with Debian to leverage each other to better the situation. My sites run either LTS or Debian and now I'm more worried.