This is a totally different issue. Distro package management isn't perfect, but you don't have to worry about a random malicious individual squatting on "openss

This is a totally different issue. Distro package management isn't perfect, but you don't have to worry about a random malicious individual squatting on "opensssl" and including compromised code. That's a whole different ball game than a bug inadvertently introduced during a backport.