Everything has these kind of bugs in them. Once upon a time it was rarely a problem because computers weren't very connected, but since broadband it's been much more profitable for hackers to find these bugs, and consequently more worthwhile for researchers to report these bugs and for the developers to fix them.
Since the probability is these kind of bugs are present in every computing device since about 1978, I see it as a positive thing these bugs are found, documented and fixed. These days, the researchers finding bugs tends to be quicker than the blackhat hackers in finding new holes (only national secret service people tend to be quicker, but also tend to be better at keeping their stuff secret than anyone else).
Debian runs multiple stable branches, and backports security fixes from their unstable branch to all currently supported branches. They have a team of people checking what needs to be patched, and then implementing it, which puts in a slightly better position than we were with the Pandora, where we only really had Notaz implementing patches to the OS and libs. We will need to do a dist-upgrade from Debian Stretch 9.x to whatever they end up calling 10.x when stretch reaches its eol, but on my personal systems I tend to use rolling release systems which expose me to bigger changes from day to day, but I don't experience many problems because of that.
