Upstream is patching security flaws just fine. The problem is that you can't get the security fixes alone; they only come along with version updates, which Debian stable doesn't want.
I understand this; I'm saying that a security process that ignores users who value stability over the latest hotness is broken for all use cases I actually care about.