Hi Otto,
In Buster's case, it would be becoming an ELTS soon and would have to use Freexian's repositories. It would no longer be the security team with DLAs that would take care of CVEs for ELTS, but the Frexian team.
So much so that if I look at the links below I didn't find anything (about security) for versions with extended support.
This point you mentioned is relevant. I will be following the finally of this conversation.
Look, I hope I helped in some way and I realize that many users don't know the Freexian repositories.
Cheers,
Leandro Cunha