Yet, the base Debian image _does_ light up like a Christmas tree when you run a snyk scan. Mostly with incorrect issues (version number causes a flag but the fix is backported) or are considered low priority and thus WONTFIX by upstream.

If you’re writing software against, say, dotnet3 (which has a docker image based on Debian) then you’re basically noised out.