You don't have to "maintain the distro" per se. You just have to backport security fixes for the subset of that distro's packages that you actually use. If you have a large organization and you only use a limited subset of the software provided by the distribution, it's not inconceivable that you might have the resources to do so.