And yet someone can discover a security vulnerability in a software package and it gets put out to every Linux distro as an update in less than a week, usually by volunteers...