You’re assuming all Debian packages are secure. Like wlesieutre said in a sibling comment, software from a trusted source can and often does have vulnerabilities.