If you want something to "just work", you're not going to be upgrading your hardware often (if ever).

That's an interesting view. So you never upgrade components on your system? That seems like a serious limitation to me.

It's a valid point actually. if you have a production server you don't upgrade parts if it's working. you just let it run, and run, and run... until it gets too old to handle the workload.

I rarely upgrade my computers. Instead, I'll build an entirely new computer every few years.

I just don't see the point in an upgrade which doesn't give me a big speed boost, and that usually means a new socket requiring at least a new CPU, new motherboard, and new RAM. Usually a new PSU is required also. Ever since I figured out how to do diskless netbooting, that's practically an entire computer right there. I keep around older computers for various purposes. There are a lot of cool and fun things I can only do with multiple computers.

I agree that's valid with a production server, but the OP specifically stated that he wasn't running one. We're talking desktop box here.

And my question is always the same - how quick does it get security updates?
I'm heavily flirting with Debian at the moment, but I want something _rather_ recent with security updates.

It gets security updates on pretty much the same schedule as Stable. There was a time, long ago, that Testing did not get security updates unless they migrated in from Unstable. But for the last couple years, Testing has it's own security team and gets regular security updates.