That would be the logical conclusion, but I believe Debian uses the old version for years after it’s unsupported and might backport security fixes depending on how severe they are. Either way, I personally wouldn’t trust Debian or Ubuntu to properly fix security issues with a program (or in this case, programming language) that they do not actively develop or maintain themselves.