> To actually do better involves imposing a lot of process so that you don't have to do much validation on each "must take" update, which is entirely doable (and is done in regulated scenarios), but isn't something that people generally want to do - it's why people pay for RHEL and similar, because they do follow those processes, which allows you to reduce validation on the "security" fixes RHEL provide.

And even if folks aren't willing to pay for that process, they're quite glad to reap the benefits from those who do. [1]

[1] Ie the many RHEL rebuilds that are only possible because a critical mass of organizations pays for "genuine" RHEL.