Security fixes are backported to Debian stable release packages. Any respectable, production-ready, stable/LTS distro does this.

Obviously you don't get the new features and functionality that may be introduced in an upstream major release, but security patches are covered.