But the backporting-security-patches thing is already done by every distro—just, not as well as grsec+pax do it. Said distro maintainers just need help to get their -stable kernels up to grsec/pax's standard—at which point the grsec/pax patchsets could be based directly on top of each distro's -stable kernel package, rather than having to do all the work of backporting again themselves.

Which would, of course, free up resources on the grsec/pax side to go toward protecting users; and, moreover, would also partially protect those users who just rely on their distro's -stable kernel, more than they're being protected today.

Perfect is the enemy of good; ideal security is the enemy of less vulnerable.