From my experience Debian uses much older versions of tools which has caused me many problems in the past (I need newer tools sometimes) but they do backport security patches fairly quickly. Supposedly 'testing' doesn't always get security updates, and 'unstable' is the wild-west of broken packages.
Would it be fair to say that the Ubuntu thing is quite reasonable, then? Presumably it's expensive to maintain this, and they already give away so much for nothing.