Sure, package maintainers may backport fixes to their old versions. But they need to fully understand <i>all</i> upstream source code and follow <i>all</i> commits. Otherwise they can miss important fixes: following only security fixes for supported branches is not enough. Sometimes project developers fixes bug&#x2F;security problem in the code, but doesn&#x27;t flag it as CVE because current code usage doesn&#x27;t trigger it. But code in old branch could.