Ubuntu accepts contributed security updates for all packages, including for those in universe. Canonical only pro-actively monitors and pushes security updates

Ubuntu accepts contributed security updates for all packages, including for those in universe. Canonical only pro-actively monitors and pushes security updates for packages in main. Packages in universe gets security updates if and when they are contributed by the community. The "majority of the work" is done by upstream really, not other distros. The remaining work is backporting and QA which is distribution-specific, since the target versions (both of the package being updated and interactions with other packages that might be affected) are not necessarily the same.