Joachim looks like Debian has conflicting information on what to consider stable
What exactley do you mean by that?
If security is a concern, Bullseye is fully supported by the security and release teams until August 15, 2024, and then gets two more years of LTS support. Buster, for example, received the latest security fix for Postfix in December, when it was already on the LTS schedule for 4 months: https://security-tracker.debian.org/tracker/CVE-2023-51764
Also, Postfix 3.5 is still actively maintained by the project itself: https://www.postfix.org/announcements.html