SLES and rhel don't simply add patches from mainline. For Ubuntu I hope it's the same. And even in the community distros you have maintainers. All profession

SLES and rhel don't simply add patches from mainline. For Ubuntu I hope it's the same. And even in the community distros you have maintainers. All professionally managed packages, kernel, libc, gcc/llvm postgres, python, etc etc have full time professional mainline maintainers. And package maintainers with a high working ethos as reviewers and gatekeepers. The problem is with leaf packages in ginornous self serviced blindly trusting huge repos like pip or cargo or younameit, npm, with huge numbers of tiny packages with no tangible responsibility whatsoever.