In the first section "What Is A Secure And Supported Version?": "We'll also count [as secure] those [known insecure versions] that are maintained by Linux dist

In the first section "What Is A Secure And Supported Version?": "We'll also count [as secure] those [known insecure versions] that are maintained by Linux distributions in supported releases" They consider (for example) any 5.4.4 install secure, even though it's a known insecure version. They're admittedly over-counting the secure installs by assuming any 5.4.4 version is the version maintained by Debian with security fixes back-ported. "So 21.71% is an upper bound on the number of secure installs."