How does it works? 1. Upstream release a new version, it goes to unstable. 2. Package is tested for some days in unstable and get promoted to testing.
So telling that testing doesn't get security updates is somewhat incorrect, since you are grabing recent software. But by the other hand having too recent software also has its downside ;)
https://www.debian.org/security/faq.en.html#testing
> there is a minimum two-day migration delay
Now you are making way to many assumptions with this phrase.
Do you really think that make sense to have critical security updates for stable having to pass through the normal release cycle? :)
I'm speaking from experience that when I was using Debian testing I would usually receive security updates days after they are available for Debian stable.
Obviously security updates for stable do not go through normal release cycle.
I wasn't commenting stable security updates, but lack of timely access to security updates on testing.