> How does Debian do it?

Debian guarantees than no package is removed from a release during its entire lifetime. This is why it's called Stable.

This can be extended to 5 years if you use LTS and up to 10 years if you use ELTS (but it's an external commercial service)