If you say "no", then you will prevent security updates for all other packages.
		
		
	 
Solvable by hand - you mustn't proceed a 
pkg upgrade to get a security update installed. In such cases I've done partially updates which left some ports without security issues behind.
	
		
	
	
		
		
			I still think a core question is how Debian is dealing with this.
		
		
	 
It is the same: If you change the environment dpkg / apt-get tries to solve this by deinstalling packages.
But Debian has stable, testing and unstable/sid - and what FreeBSD (quarterly) does matches best testing ("you can get packages that are known to work, but sometimes a dependency of something you've already got installed can be broken"); And so a testing user knows that kind of problem, too. Whereas users using stable ("such problems may occur, but are seldom") blame the old package versions: The price of becoming everything "in one line" means much time at the package freeze (!), and another infrastructure as well as more manpower to the package building environment. And backports, modified instead of original software etc…
But on a closer look it is the same on all package systems with dependencies. Not solvable - except you're freezing all port versions and publish them only if and when everything is solved. Means: Publishing outdated software.
This situation is like you're telling the electrician to update all your sockets to a newer system, but you're still having one device which is at the moment not available with the new plug. On Debian stable all packages have to wait till everything is solved ("freeze"); On FreeBSD you can get the newer versions immediately, but if something is missing you have to say "okay, I'll wait till it is ready" - or you say "okay, the deal of missing XY for some days is okay to me". The default is "no".
Whereby Debian started not to wait until everything is ready - instead of that, nowadays even supposedly unimportant software is simply left out. The schedule has to be kept (in the past: it's ready when it's ready).
	
		
	
	
		
		
			Major applications like web browsers
		
		
	 
The procedure for browsers is an explicit exception to the usual Debian procedure.