You make a good point here -- the time-to-deployment is significant as well as the time-to-resolve. It's also true that once a fix is available in any Linux so

You make a good point here -- the time-to-deployment is significant as well as the time-to-resolve. It's also true that once a fix is available in any Linux source tree, advanced users can begin to use it from that moment onwards. Arguably some users could develop their own workaround or solution even before one is available upstream, should they want to (because the code and tools to compile it are all available to them). (similarly it'd be valuable to analyze how long it takes for the majority of end-users to upgrade across common operating systems. something like this chart[1] of Firefox version traffic history, but for security fix rollout) [1] - https://web.archive.org/web/20201220010043/https://paulcalvano.com/assets/wp-content/uploads/2017/11/FirefoxBrowserVersionTrafficHistory_20171126.jpg https://web.archive.org/web/20201220010043/https://paulcalva...