That's a good question! I have no clue, but I know that they also patch unsupported packages that probably aren't getting updated anymore. I'm not sure how they

That's a good question! I have no clue, but I know that they also patch unsupported packages that probably aren't getting updated anymore. I'm not sure how they assess which packages are vulnerable but I guess some of them already have a fix upstream that didn't go through the (debian or ubuntu) repo maintainers yet.