Not every OS connected to the internet can afford the risks of bad updates (which are far more common than proponents think/claim)
Debian package management doesn't have to rely on an internet connection. You could have the source of the security updates be a cd or USB stick or something with no problems