Eh, upstream is not always the best either. Sometimes they don't fix security issues. Sometimes upstream is very change happy and the distribution will do best

Eh, upstream is not always the best either. Sometimes they don't fix security issues. Sometimes upstream is very change happy and the distribution will do best by lagging behind "and see what happens".