I claim no deep expertise on this, and I assume Canonical has more money to throw at this. Or are there contributions to Debian security in the form of paid personnel?

This is actually quite interesting to me, anyone with real knowledge of the subject is welcome to interject.