Support for version 1.0.1 ended on 31st December 2016. Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates.
Since 1.0.2 is not vulnerable, it seems unlikely that the bug would be in 1.0.1.
</s>
I love Ubuntu; the "LTS" part is a bit of a joke.
A cursory look at the Ubuntu security advisories page shows that they have back-ported OpenSSL for both 14.04 LTS and 12.04 LTS. There's one from a few weeks ago for both[2], and there are many more that have been done.
We certainly provide security updates for packages in main for the LTS lifetime.
I understand where the difference comes from though, Debian. The problem is that Debian serves a different need, and is not really an "enterprise" distro. That's not to imply it isn't a quality distribution, but their purposes are not necessarily aligned with the needs of organizations which may be managing hundreds or more systems all at once. Debian "backports" newer packages from testing to to current to deal with needed fixes, while enterprise distributions "backport" the patches to make sure the package behavior doesn't inadvertently change due to some other changes in the package during the time since it was first included.
Ubuntu's beginnings as an offshoot of Debian show here, but that's where there's a disconnect between the terminology they use and that of most other distributions that target the enterprise (which admittedly Ubuntu only does partially). I can't really blame Ubuntu for their use of the terminology, since it does have historical precedence for them, and they are't even entirely an enterprise distro (by which I mean they also target desktop usage heavily, compared to RHEL which only goes as far that direction as to target workstations, and somewhat halfheartedly IMO).
https://people.canonical.com/~ubuntu-security/cve/pkg/openss...
The extra icing on the cake? They removed OpenJDK 7 from 16.04 despite it still being supported. :-/