Debian LTS?

So true. Most projects don't support any older version. If there's a bug, than it's fixed in the next release. You are expected to run the latest if you expect quality from those projects.

The problem is that this model fails when you have lots of interdependencies. This is where distributions step in and try to get the correct mix that can be regarded as stable.

But in the process they have to maintain version stability (partly because people expect their things not to change (any change can change something for the enduser, often positive but the negative ones are not tollerated) and partly because it's almost impossible to oversee the consequences of the whole when something is changed).
So distributions (and the expectations people have of them) are effectively the reason for needing security updates on older versions for most FOSS out there.