Wait, if a reliable upstream wrt timely security fixes is a recommendation or requirement, we might have to get of a *fair* share of the archive... and that's not only the unmaintained software!
Well i meant both security and other updates. In the case where no better upstream exists, it is acceptable to have a lame one. However in the case of QIII I'd be willing to bet that no less than 3 better upstreams exist already. After all Q2 has quakeforge, so I'd find it hard to belive nobody has started something similar.
Basically, as a rule, one should use the best upstream available. In no case would that be ID software.