Debian-updates are pending packages between dot-releases,
they are not security updates. When Debian has a dot-release,
for example 8.7, debian-updates is empty. Between 8.7 and 8.8,
updates packages go to debian-updates, and on 8.8, all packages
in debian-updates are moved (or replaced) by packages in the main
repo, leaving debian-updates empty again. Security updates are
managed outside of this.