Unfortunately, I think people who think the same are in a minority. And some distros are also attempting to shy away from the responsibility (first few Ubuntu

Unfortunately, I think people who think the same are in a minority. And some distros are also attempting to shy away from the responsibility (first few Ubuntu LTSes had a huge catalogue of python libraries in "main", which meant that they had 5 years of security fixes while keeping backwards compat guaranteed). I seriously believe there is a business opportunity for people to manage security of others' dependencies (backport patches and push backward compatible fixes). Higher levels could even get security audits as part of their package.