- the distribution to recompile and test all binaries using a vulnerable dependency [x]

- users to download and update all affected binaries

compared to:

- the distribution patching a single package

- users updating that package

Imagine if OpenSSL was statically linked: even the smallest fix would require users to update half of the OS. And that would discourage both maintainer and users from doing regular updates.

[x] And this is assuming that thousands of automated rebuilds are possible. In reality many statically linked languages encourage locking the versions of build dependencies, making it impossible to do just one backport of a patch.