Unstable is pretty dang stable.
http://www.debian.org/security/faq#unstable
And Testing doesn't get fixes for contrib and non-free:
I checked the security site listed in the Testing area in the Debian FAQ and don't see the recent SSH fix or the recent Linux kernel fix.
http://www.debian.org/security/
I do see them on the Ubuntu site: