No. All the official packages in the main repo get security updates from the Debian security team.
Only the packages in contrib, non-free and non-free-firmware don't have official security updates and rely on the package maintainers. These are not considered part of the Debian distro, and I don't even have them enabled on my servers.
Out-of-the-box, Debian only enables the main repo, plus the non-free-firmware one if any of your devices require it (e.g. Nvidia graphics, Realtek Bluetooth, etc). You have to manually enable contrib and non-free, and by doing that, it's assumed you know what you're doing.
In the case of non-free and non-free-firmware, they can be closed source software (like the Nvidia drivers) or have a non-open-source license that doesn't allow distributing modified versions. In those cases, the Debian team is unable to patch them even if they wanted to.
So users just run insecure packages on Debian?
No. All the official packages in the
main
repo get security updates from the Debian security team.Only the packages in
contrib
,non-free
andnon-free-firmware
don't have official security updates and rely on the package maintainers. These are not considered part of the Debian distro, and I don't even have them enabled on my servers.Out-of-the-box, Debian only enables the
main
repo, plus thenon-free-firmware
one if any of your devices require it (e.g. Nvidia graphics, Realtek Bluetooth, etc). You have to manually enablecontrib
andnon-free
, and by doing that, it's assumed you know what you're doing.In the case of
non-free
andnon-free-firmware
, they can be closed source software (like the Nvidia drivers) or have a non-open-source license that doesn't allow distributing modified versions. In those cases, the Debian team is unable to patch them even if they wanted to.