This is always a spectrum from how long it was since the last Debian stable release. So about 2 years max.
Modern release cadences make it crazy anywhere but Debian, but security patches are very timely. If you're dealing with newer features, driver support or java/npm packages you're probably also outside the typical defaults, but there's generally some people working to keep the common ones up to date.
Still not my preferred way to handle updates and in some cases... kind of abusive to the maintainers who constantly haVE to deal with bug reports from "out of date" Debian users. The xscreensaver maintainer has some choice words. But it works, has for years with no sign of slowing.
I believe not wanting to put the guy back in who did nothing as the Saudi's bone sawed one of your writers falls into; common sense.
Bozo thought his own op ed was more important than the journalism of his "editorial board", people who he presumably pays to write opinions. People who are journalists.
He thinks he's an astronaut and a journalist because he can buy rocket companies and papers, but he's a clown demonstrating his own lack of understanding of bias in plain English, his paper is worth but the circus music following him.