In both Debian and Ubuntu, only the main repo gets official security updates for free. Ubuntu has a paid option for universe whereas Debian doesn’t have that option and relies on the package maintainer to provide any updates.
I’d still recommend Debian over Ubuntu though, for various reasons.