While there are exceptions, generally stable releases of Linux distros backport important security fixes rather than packaging new upstream versions. They do this because the new upstream versions usually contain unrelated changes and every additional change brings more risk of regressions.
Unfortunately in most cases (again there are exceptions), the output of "
program --version" only indicates the upstream version, not the distro-specific revisions. So it is not generally a good indication of whether a security fix has been applied.
Generally security fixes will be listed in the package's changelog which can be found at
/usr/share/doc/<package>/changelog.Debian.gz. You can also check the installed version of the package against Debian's security tracker.
Debian addressed CVE-2021-3156 in version 1.8.27-1+deb10u3 and that quickly filtered its way down to Raspbian. There have however been some more minor issues raised since then that Debian has not seen fit to issue a security update for.