That's skipping a few steps :) Debian patched out some artwork because it didn't follow their license requirements, and the patches to remove the artwork ended up violating the trademark license. The trademark owner then did what trademark owners are required to do.

As I stated above, the artwork is now free even by Debian guidelines, so the only thing holding back Debian there seems to be inertia.

If you really want to go into the gritty details - in 2005, Gervase Markham, representing himself as speaking on behalf of Mozilla in this matter, indicated that what Debian was doing was okay:

https://lists.debian.org/debian-devel/2005/06/msg01182.html

In 2006, Mike Connor contacted Debian and stopped just short of saying outright that Gervase should never have done that:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=354622#59

(Also see the next few messages from Eric and Mike where they worked out some of the details)

So the short version is that there was a lot of confusion from Mozilla about what Debian should be doing here, and at each step Debian adjusted the contents of the package in accordance with the information given.

As far as the artwork license is concerned, that's actually a distraction; the conclusion of the discussion with Mike Connor was that Debian could only use the firefox trademark if the Mozilla Foundation was pre-approving all releases, and it would be quite tricky to make this work with Debian's release processes. Using the iceweasel branding is much less work for everybody and doesn't seem to cause any problems for users.

Doesn't Debian also include backported security patches that aren't part of the upstream source?

Iceweasel is based on the officially supported Firefox versions, so upstream by definition has all the security patches.

The idea is that when a security bug is found, Mozilla writes a patch against the current Firefox version, but Debian must patch whatever version is the Debian Stable, so they must write a patch to the earlier version of the source. Since the code has changed in between, the patch is different, even if it fixes the same bug.

Mozilla writes patches against all supported Firefox versions (that's what being supported means!), and as already stated, Debian only uses officially supported versions for Iceweasel. So no, there are never security patches that Debian needs to backport for stable because they are always already upstream.

Look, the version of Iceweasel in Debian Stable is based on Firefox 24. According to the Firefox ESR calendar, Firefox 24 will got out of support in October. But the new version of Debian Stable won't be released before December, at least, and Debian doesn't upgrade the major version of a package in Stable.

So how exactly can Debian patch Iceweasel using Mozilla's patches between October and January?

Debian will switch to a version supported by Mozilla, just as they've done the previous times. See for example: http://lwn.net/Articles/552920/