You know, Debian is an almost 18-year old distro and the episode you're pointing at is 6 years old. By looking at Debian's past you can find *many* mistakes, statistically many more than those you could find in the history of a younger distribution.
From Debian's mistakes, many distros out there have learned how do better. Including Debian.
You can find the current track record of Debian security updates at http://www.debian.org/security/ (which, just as an example, shows an average of more than 1 update/day for March 2011).
Posted Apr 1, 2011 12:37 UTC (Fri) by rahulsundaram (subscriber, #21946)
[Link]
That's not a very useful metric. It shows Debian is actively releasing updates that fix security issues but doesn't help show that issues are being handled in a timely fashion. If a distro wants to publish metrics for security errata, look at