The opposite is true: new vulnerabilities can be introduced in new feature releases, while older releases can receive backported security fixes. That means tha

The opposite is true: new vulnerabilities can be introduced in new feature releases, while older releases can receive backported security fixes. That means that the level of security of a well maintained stable release train can only increase over time. This is why Debian puts so much effort in freezing and baking the distribution and backporting security fixes.