The Debian maintainers do backport security fixes to the older version they're shipping, though. Eg. for the package in question here we have: xscreensaver

The Debian maintainers do backport security fixes to the older version they're shipping, though. Eg. for the package in question here we have: xscreensaver (5.30-1+deb8u1) jessie-security; urgency=medium * Add upstream patch for "xscreensaver aborts when unplugging second monitor" security issue (closes: #802914) http://www.openwall.com/lists/oss-security/2015/10/24/2 -- Tormod Volden <debian.tormod@gmail.com> Sun, 25 Oct 2015 11:35:52 +0100 Keeping the old version isn't supposed to imply "it has no bugs" - instead, it's based on the idea that "if if works for you now, it will continue to work for you". In other words, you can be reasonably sure distribution point updates won't break anything that you're relying on.