When do critical security updates hit PureOS?

PureOS still hasn’t updated Chromium to 117.0.5938.132 so I think I’m missing something. I’m new to Debian but it looks like the latest Chromium there is the same as on PureOS:

What is the right way to proceed in a situation like this?

Regarding Flatpak, some apps in Software (such as Chromium) don’t have anything in the top right, but maybe the Sandboxed flag further down the page is a good way to determine if it’s Flatpak? If so then Chromium there is not Flatpak.