It is open source; they are corporate users. Why don't they collectively hire someone to backport security patches? Sounds like a businessmodel to me. You can't

It is open source; they are corporate users. Why don't they collectively hire someone to backport security patches? Sounds like a businessmodel to me. You can't really expect support and consideration for your minority use-case for free, if you aren't paying for the software in the first place.