They backport security updates to the existing software versions on stable, which causes the packages to be secure without introducing new behavior. Feature updates only occur with a new stable release I believe.