Debian usually backports security fixes to older versions, so you may wanna check to Debian if they have an updated version of the package with the security fix.
This can be done by taking the CVE number related to this vulnerability and look at the package changelog.
They do encryption at rest too. Really good notes app and it’s cross platform too. Only missing a “web” client for when you want to access your notes on a computer without Joplin installed (but that defeats the purpose of the E2EE IMO)