If this link in the tracker is accurate, I believe @wctaylor is correct about updates in general, though not necessarily security items. Note “The landing suite is synchronized with Debian testing main.” It still takes time to get to ‘green’ for us to see it.
I never have found or received a good explanation for how packages are propagated, and it is frustrating at times. I had to create a Task to upgrade Thunderbird for Efail, because it was months behind, even in April when I first received my Librem.