Debian has already done this. I noticed when I ran updates on two of my Debian 10 “Buster” boxes. I compared the security repo from the source.list to the one Netrunner has. Once I corrected Netrunner’s /etc/apt/sources.list file the error went away. The corrected changes to the line should read
deb security debian org/debian-security buster/updates main contrib
I had to remove the http:// and periods because the forum editor kept making it a link. Netrunner’s source.list just use / in the security repo. It was changed to /debian-security .
Once Debian Buster was moved to old-Stable, the Debian Security team is responsible for updates for about 1 year give or take a few months after the year.
Though for Buster you will want to keep the buster/updates.