the Debian security repo URL should be tor+https://security.debian.org/debian-security. Currently in Whonix 17.4.4.6 it is tor+https://deb.debian.org/debian-security. See SourcesList - Debian Wiki
deb.debian.org isn’t wrong, is functional.
https://www.reddit.com/r/debian/comments/hdrhus/are_securitydebianorg_and_debdebianorgsecurity/
Quote LTS/Using - Debian Wiki
deb Index of /debian-security bullseye-security main contrib
Quote a Debian Developer Re: Debian security repository canonical URI?
Both of these URLs point at the Fastly CDN, so they are equivalent.
See also:
If you wish to pursue this further, please post on the Debian mailing list to make a Debian Developer discourage or mention any disadvantage of use of deb.debian.org or find an existing post by a Debian Developer doing the same.