Problem was that the commented variant only was a new, $dist-security one, but is also written if the security repo is disabled with other distributions than sid/unstable.
0da2ed1365