Documentation was updated just now. The part which answers your question is quoted below at the time of writing but users should read if from the up to date version going to and going from there:
It is quoted here for convenience, for easier quoting from it and discussion.
These instructions are for Debian
buster , which is recommended. Other Debian releases might work, but this is untested. In that case, replace
buster with the actual codename your release.
Note: this applies to Whonix
15 . Later Whonix versions may use a codename different to
virtualbox should be installed from Debian unstable (codename:
sid ). This is non-ideal but required since VirtualBox in unavailable in Debian
buster-backports at the time of writing. It has risks such as bricking the apt package manager. Therefore users should make sure to have their backup and restore process functional. Alternativly you could install from Oracle Repository but this comes with different risks.
What makes you conclude that?