Take a look at this post to see if it applies. It mentions the same message following upgrade from buster. The key point is:
Upon closer look, it seems that the content of /etc/apt/sources.list is no longer valid. stable/updates should read stable-security. So, where it reads:
deb http://security.debian.org/debian-security/ stable/updates main
deb-src http://security.debian.org/debian-security/ stable/updates main
it needs to be changed to:
deb http://security.debian.org/debian-security/ stable-security main
deb-src http://security.debian.org/debian-security/ stable-security main