Debian does have control over the third party elements that Debian has in its MAIN repository. Which may be changed by Debian to make them more aligned to the whole and be maintained by Debian. For entry into MAIN the program/package must comply with the Debian Free Software Guidelines (which includes being open/free software); Must not require or recommend a package outside of MAIN for compilation or execution; And must comply with Debian policy. In effect what could perhaps be described as being source code 'owned'/modified/maintained by Debian.FreeBSD also only puts out security updates "as and when required" so I don't understand what's different. Program updates for security reasons has nothing to do with FreeBSD. Those are third party elements FreeBSD has no control over. Neither does Debian for that matter.
I run my Debian installation using their MAIN repositories only, and as a example following Debian tweaks Nvidia tends to work better via the Debian provided drivers than that provided by Nvidia. Stick with just that Main repository and its very stable and all provided/maintained by Debian.Debian is vastly more than just a Linux kernel and core operating system.
In addition Debian provide access to "contrib" and "non-free" repositories ... that are outside of Debian so-to-speak. And there are the different versions, oldstable, stable, test and unstable (development). And they support 9 different architectures (arm, amd, i386, mips, ppc ... etc.).
Whilst FreeBSD has similar elements/policy, IMO its (considerably) less comprehensive.