Updates in Debian Stable cover more than security fixes. The bulk of updates are security fixes but that's because many maintainers are not even aware that updates for important bugs (i.e. not even Release Critical) are accepted if the fix is non-invasive.
You might want to check Philipp Kern's recent talk at debconf. There are slides on the page below as well.