I looked behind the scenes quite a bit in Debian and what you say mirrors what I saw. The project is very political and does suffer from a serious lack of man-(and woman-)power in many areas. If you do want to help, you're almost immediately hampered by the community's Byzantine structure.

If that puts you off, Arch is a more dynamic project that's easier to get into as a maintainer. But it's also organized with a more hierarchical and less democratic structure.

Additionally, you'll find the issues Debian has all over the FOSS world (The Linux kernel is especially bad). And if you work in corporate IT like I do, you'll soon notice that proprietary software organisations are no better. There's software many people depend on maintained by a single overworked and struggling person everywhere you look. Yet it still works somehow. Cause wherever there is demand, a solution is found. And Debian at least has a long-established structure with the goal of finding that solution, even though it's antiquated.

There’s truth to what you’re hearing, all open source software is suffering.

Part of the allure of rolling releases for the places that have to maintain them is less maintaining! Debian does need maintainers.

Debian does ship old packages, that’s the point of “stable”, to be tested and known not to cause problems.

Free software is political. It’s literally not possible for there to have been more time spent discussing what to put on the website than looking for maintainers and updating packages, and part of stability isn’t active testing but instead time spent in active use.

Debian is on the same path it’s always been on, and reports of its imminent demise are exaggerated.

I use the Debian social contract as an example of the an unmitigated good in open source.

That doesn't mean the org always live up to it, but that's partially why there are battles for things like representation inside. I wouldn't extend the benefit of the doubt to canonical, and I prefer rolling as opposed to security ported updates on my own hardware, but they made what you see possible on the internet in large part because people came together to make a free platform.

The orgs dogmas look like product of a bygone age to be, and changes to environment in software is probably as hostile to their approach as ever. I'm amazed they're not more dysfunctional just from the outside looking, it's a rock solid implementation.

Tumbleweed includes the YaST package manager with all the repository priority settings that make sense in Leap, but the TW documentation tells you not to use it.
You can run zypper up which is a standard updating method in Leap, but the TW documentation tells you not to do that. More than half the zypper options make no sense in TW.
That's the stuff I mean by "derivative". They built on a Leap base and modified it into a rolling release.
If it was truly designed as a new, independent rolling release distro, they'd have taken those things out, packaged a different version of zypper or at least a different manpage.