Usually, a maintainer will step up and build packages for a given project. Be it one developer or a small team thereof, it's definitely not the entire community (and in fact can be unrelated to the community.) However, as distribution versions are end-of-lifed, packages stop receiving non-vital (AKA: security-only) updates, and that's not the fault of the Rails team or even of that maintainer.