Ubuntu accepts contributed security updates for all packages, including for those in universe. Canonical only pro-actively monitors and pushes security updates for packages in main. Packages in universe gets security updates if and when they are contributed by the community.<p>The &quot;majority of the work&quot; is done by upstream really, not other distros. The remaining work is backporting and QA which is distribution-specific, since the target versions (both of the package being updated and interactions with other packages that might be affected) are not necessarily the same.