My company actually sells CentOS and Ubuntu based appliances (B2B) and we provide customers with updates (which they can choose to install or not) whenever a security problem is found. But we do NOT upgrade major versions in the field - we try to release our latest and greatest with the latest LTS release, and then provide any updates to that LTS. After the OS support period expires, we work with customers to migrate to the newer version of our entire system, instead of trying to provide further security patches.