If you use apt-get to upgrade to buster, you won't be asked about the security repository info changed from 'testing' to 'stable'. Use the --allow-releaseinfo-change option, as Eriberto Mota explains here: or use apt instead dlvr.it/R7ysNd

Also, WHY ON EARTH don't you provide SSL #TLS #HTTPS for security.debian.org ? This way it currently is, hijacking cannot really be prevented.

The way the mirrors work mean all the mirrors running behind it would need a trusted certificate for security.debian.org However, do try deb.debian.org as that works differently, "deb deb.debian.org/debian-securi… stable/updates main contrib non-free"