Package maintainers apply patches and roll a new package version (e.g., +deb11u1).
At some point the package maintainers themselves may not want to babysit things anymore and deprecate the package. But most packaging systems that I'm aware of have mechanisms for applying patches.
In many cases even if the software itself is still maintained, the package maintainers may only apply a specific patch to ensure maximum compatibility.
It's why many of us prefer 'slow moving' distros with "old" packages: minimal change for a given version and then only when 'necessary'.
I very much hope not.
I would greatly prefer to see some certification bodies arise that can vet libraries for exploits like this and give a certificate of some sort saying "This library is safe to use".
Of course, that requires them to have some extremely good exploit-finders.
> Log4j and java packages exist for example in operating systems that get security updates - and continue to do so for the life of the operating system.
But how does an updated OS help if the packages themselves are not updated?