Setting APT::Default-Release prevents installation of security updates in bookworm!?

Hi debian-security,

I've just noticed something rather distressing. As part of my usual Debian
installation I set `APT::Default-Release "stable";` which causes a change
of apt priorities for packages from this release (or so I thought) from the
usual 500 to 990. This is recommended in various places, but I don't recall
if d-i sets this up by default or not.

It seems packages from the debian-security repository are not affected by
this increased priority and will not get intalled as a result. Note:
`apt-cache policy` tends to lie. I observed this by actually trying to
install a kernel update from d-security that should get installed but
doesn't.

As soon as I remove the Default-Release line from apt.conf the update gets
offered for installation. Has anyone else observed this or is something
broken in my apt config somewhere?

--Daniel