Raspbian actually has more of a problem with security updates than some of the competing distros, because the original Raspberry Pi and the Zero use an obsolete

Raspbian actually has more of a problem with security updates than some of the competing distros, because the original Raspberry Pi and the Zero use an obsolete ARM sub-architecture that none of the major upstream distros support, so they have to recompile every single package. If you use a board supported by the Debian flavour of Armbian for instance, that gets security updates for everything but the kernel and bootloader direct from the Debian stable repositories.