Are you really saying that Debian is an unstable distro? Regarding security, can you name one security update Debian did ever fail to apply on time? Because it's pointless to compare feature updates and security updates.
The reason Debian is known to be "outdated" regarding features only is exactly why it's considered one of the most, even if not the most, stable distro. Because it's long time tested between upgrades.
My subjective opinion: he uses it because of bleeding edge kernel version. And it is surely, for him more than anyone else, an important point. But it doesn't mean older kernels are not secure, they can be patched when needed. And the "needed" varies, for some distro it means it's just not the last one, for others that additionnal and interesting features are added. For Debian, it means patching vulnerabilities if there are, or take the required time to offer a tested and coherent pack of updates. Because otherwise there is for now, no need. Testing is a specific point that no other distro has ever did better than Debian, but the same reason why it feels old to many and not enough up to date, regarding features.
I'm obviously a Debian advocate, but I'm not saying it's in general the best distro, there are none. Only best for some usage, and not for others.
But it doesn't make it unsecure (that's partly why it's one of the most used server side) and "holding back" updates. :)