> I don't know anyone who uses Debian and actually sticks with their packaged apps.
With various indications that they more or less actually do stick to the packaged apps.
Anyway, I for one don’t think that staying with for example nginx for two years on the same version is a good idea. Even if they fix security issues, you still miss out on features.
And this is for lots of other packages.