Thanks for the clarification but reading the FAQ again for both Unstable and Testing in the context of your comment I'm still struggling to compare it to how Ubuntu gets security fixes for example.

I checked the security site listed in the Testing area in the Debian FAQ and don't see the recent SSH fix or the recent Linux kernel fix.

http://www.debian.org/security/

I do see them on the Ubuntu site:

http://www.ubuntu.com/usn/