This can also be a downside where the fix reveals the vulnerability and it begins to be exploited before distros get fixes out.

Iirc there recently was a big one where the fix was snuck into a large Linus patch and not revealed until all distros had a chance to release updated kernels.