Well, if you read some more of jwz's blog posts about the horrible security bugs that others have added while creating derivatives of Xscreensaver you might think twice before doing so. https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition For me a screensaver is no longer about trying to prevent dead pixels (or something like that) but being able to safely lock the screen when being away from it for a while.

xfce4-screensaver isn't packaged for debian stable as of yet, but I've built it from source with only minor hacking required to get it to run with the current version of everything else. Problem solved.

If you received constant complaints from users about bugs that you had resolved years ago, but package maintainers refused to package, you'd probably get sick of it too.

Daniel Stenberg (author of curl) has blog posts about how everyone in the world uses curl, and as a result include the curl license in their readme, which means he gets mail from people upset about their car not working.

Steam had a big thing recently because the snap of Steam is not official. But yet, they get a TON of bug reports for things that are only broken in the snap.

I imagine having the same conversation of "That bug is already fixed as of 8 months ago" "Well how do I install the latest release?" "I dunno, talk to your distro about that" on a super regular basis, it starts being something that is incredibly infuriating. No one wants to take the anger of aggressive upset people, especially when the fault lies with someone else. He has asked Debian to stop shipping out of date versions of his software in the past. But because open source, they are not obligated to, so he has very limited ways to protect his own interests.

Your issue sounds like it's with Debian for shipping incredibly out of date software and putting jwz into this position in the first place and not with jwz.