they don't always stick to only the versions of the packages supplied by Debian though.
I run debian on a few hundred systems, but there are a half dozen or so packages that I consider critical and run more up-to-date versions of (the kernel being one of them)