The Debian repo’s are always behind due to extensive testing etc. Some time ago when the Debian repo’s were trailing with 3.1 and 3.1.1 was the actual version everyone wanted, many images (including the emonSD) started using the Mosquitto.org repo’s directly and I suspect, simply haven’t switched back.
There will always be leading edge releases for almost all softwares that take time to filter through to the “stable” branch of the Debian repo’s, so unless there is a specific post 1.4.10 feature/fix you desire or you just like flying by the seat of your pants (with potentially unstable code), you will probably be better off with the Debian “stable” (aka Stretch) repo to avoid any discrepancies in dependencies etc.
If you do want everything cutting edge (not just Mosquitto) you could try running “Buster” which is the “testing” branch, that is using version 1.4.14 of Mosquitto.