debian testing do receive security patches, but it is not a priority so they may not get there in a timely manner.
Yeah. I'm aware that stable and old stable need to be patched first, I was just surprised by how much time it took considering the kind of risk (and being beaten by sid, the kid whom always breaks his toys).