While this fix looks appropriate to me for a development release, I don't think for an SRU it makes sense that we should change the debootstrap script to be safe under set -u when debootstrap itself never uses set -u. I think mmdebstrap should set +u before sourcing debootstrap scripts (it can set -u again afterwards) and that this would be a more appropriate change to SRU.
While this fix looks appropriate to me for a development release, I don't think for an SRU it makes sense that we should change the debootstrap script to be safe under set -u when debootstrap itself never uses set -u. I think mmdebstrap should set +u before sourcing debootstrap scripts (it can set -u again afterwards) and that this would be a more appropriate change to SRU.