I have Debian on my servers for a decade or so, and on several workstations. My past experience doesn't quite reflect that. The Debian guys and gals have always been pretty quick with patching the vulnerabilities. Like outstanding fast.
There is some merit to the bugfixing. But that's kind of the point of Debian Stable(?!) Like in the meme picture of this post I don't want updates each day. And I also don't want the software on my servers to change too much on their own. I know my bugs and have already dealt with them and I'm happy that it now works seamlessly for 6 months or so...
And that's also why I have Debian Testing on my computer. That gives me sort of an unofficial rolling distro. With lots of updates and bugfixes. I mean in the end you can't have no updates and lots of updates at the same time. It's either - or. And we can choose depending on the use-case. (I think the blame is on the admin if they choose a wrong tool for a task.)