VyOS security patches, are they a thing?

I've been using VyOS (open source fork of Vyatta) for the last year or so, and I don't think I've ever seen a security patch. On their web site, the latest stable release is 14 months old. This thing is built on top of Debian, but the docs say not to run apt-get because it will break stuff.

So I'm running some 14 month old Linux system with no patches. I'm basically fucked and need to dump it for something that's kept up to date, yeah? Or is there something I'm missing here?