I updated debian on DO like 25 minutes ago and had a crystal-clear bash update there. So I guess they updated their mirrors.

Debian security updates are distributed from security.debian.org, which is separate from the normal Debian mirror network, and Debian discourages the mirroring of security.debian.org because security updates are time sensitive. Hopefully Digital Ocean is not mirroring security.debian.org.