Technically, you are right. But this is due to the different release systems.

In Debian, security updates for the stable version are distributed via the security repository until a new point release is created. The last point release was two months ago.

However, in practice, on Debian Trixie, you get the fixed version by running a standard apt update & apt upgrade.