Not that I approve the Debian decision here, but calling it "classic" seems a bit of a stretch?

Do you have many more examples to call that a "classic" Debian security behaviour?