There are two actions that need to be taken: 1) fix the bug in the vulnerable package (cut a new version) 2) make sure the new, bug-free version is actually i

There are two actions that need to be taken: 1) fix the bug in the vulnerable package (cut a new version) 2) make sure the new, bug-free version is actually in use 1 is the responsibility of upstream (though sometimes distros will do this too, and release it themselves while they try to upstream the patch). 2 has to be done by somebody for every application using the vulnerable package, either a) automatically (for example, by Debian releasing the new log4j version and all dependent applications picking it up at runtime) or b) individually (by each dependent project's upstream updating the dependency, cutting a new Flatpak or container image, and getting users to update it). a is much more pleasant than b, at least in the universe as currently constituted. We can imagine a world where b is mostly automated so it is about the same or less work, but we don't live in that world yet.