security updates I would be getting for free on Debian.

Debian contrib doesn’t get official security updates, the same as Ubuntu universe. https://www.debian.org/security/faq#contrib

In both Debian and Ubuntu, only the main repo gets official security updates for free. Ubuntu has a paid option for universe whereas Debian doesn’t have that option and relies on the package maintainer to provide any updates.

I’d still recommend Debian over Ubuntu though, for various reasons.