You are correct about everything shipped in the stable distribution except web browsers. Firefox, seamonkey and chromium (thunderbird too) not only receive updates when there is a bugfix update, they are also updated regularly as soon as there is a new upstream release.