What about security updates? They might come slowly to unstable (since security team doesn't concern themselves with unstable) and might be held up arbitrarily

What about security updates? They might come slowly to unstable (since security team doesn't concern themselves with unstable) and might be held up arbitrarily long before trickling down to testing, no?