But it goes the other way too. If there's a security vulnerability that was fixed in a later version, you want the system to automatically pick that up and apply it for you in an ideal scenario.
We have things like dependebot for this.
https://docs.github.com/en/code-security/tutorials/secure-yo...
What you're looking for are Debian stable packages. :p
Yes, if they all just backport security patches we'll be fine. No, people are not going to just.
Security patches aren't like bugs or features where you can just roll a new version. Often patches need to be backported to older versions allowing software and libraries to be "upgraded" in place with no other change introduced.
Say you had software that controlled the careful mix of chemicals introduced into a municipal water supply. You just don't move from version 1.4 to 3.2, you fix 1.4 in place.