Not so easy but still possible with the right tools. Its more that you aren't allowed to do it yourself with those AC-units. You need specific certifications to fill them.
The issue is not that Debian has unpatched versions. They backport security updates so it is completely safe. But a lot of those scanners don't understand this and just see version x.xx.xx.x which is under the latest stable