I have actually fixed the problem with the 0 packages from debian-security (the fix is available in the pulp_deb 2.13.0 release, but probably won’t be available within Katello for some time). The Problem was 100% the component. For debian-security the components are named updates/main in the Release file, instead of just main. As a result when you set Components: main in Katello (that is in the pulp remote), it does not find any components with that name and therefore does not sync anything but the metadata. You should be able to work around the problem by using Components: updates/main instead. The fixed version of pulp_deb will work with either entry (main as well as updates/main).
Not setting any component also works.