Why does that mean unmaintained? Maybe there is nothing more to add. It's just a small base image which probably does everything it should for the creator. There also are no open issues or PR. Funny how no commit in some time equals unmaintained nowadays.

Wouldn't there be security patches/releases in that time? Or do they not sit in the repo?

One can always do apt-get update && apt-get upgrade && apt-clean (the last being a convenience command by TKLX) in their first RUN after FROM.