I simplified a bit. Yes, Debian testing gets new updates, which means it gets security updates. Eventually. It can (and does) take days for critical security updates to migrate from unstable to testing after stable has access to patched version.
https://www.debian.org/security/faq.en.html#testing
> there is a minimum two-day migration delay