Sure, but even in those "few cases" Testing will get them soon.

I did read at some point that Testing may receive security updates later than stable, might be in those cases in which backports come straight from unstable.

I don’t recommend going for (Debian’s/Devuan’s) testing (branch) as it targets a peculiar niche that I fail to understand; e.g. it doesn’t receive the security backports like Stable does nor does it receive them as soon as Unstable/Sid does. Unstable/Sid could work, but I would definitely setup (GRUB-)Btrfs + Timeshift/Snapper to retain my sanity.

From https://backports.debian.org/ :

Backports are packages taken from the next Debian release (called "testing"), adjusted and recompiled for usage on Debian stable

So by definition, security backports in stable are present in Testing in the form of regular packages, right?

That's a valid opinion. And I admit that at some point you must move to some form of client-side rendering.

I still haven't (for some admin panels too, and websites), so I don't feel the need to switch.

Aren't you only saying, indirectly, that server-side rendering is "antiquated"?

Unless you mean that mixing logic with templates is bad, in which case I agree.

you can easily forget to catch it and handle it properly

Even if I coded the form by hand and that happened, it's on me, not on the programming language.

But I don't, I use a framework which handles all that boilerplate validation for me.

When you say user, you mean a user of a function? In that case PHP would throw a TypeError, and presumably only happens when developing/testing.

If you mean in production, like when submitting a form, an Exception may be thrown. In which case you catch it and return some error message to the user saying the date string is invalid.