Comment 8 for bug 891747

This only happens if there is both a package in -security and a package in -updates. Typically, packages in -updates need to wait a week in -proposed before making their way to -updates. For most installations, unattended-upgrades will have updated to the package in -security before the more recent package would have appeared in -updates.

I understand that this may result in certain systems not being updated to the latest security releases, but this by itself is not typically what would be considered a security issue.