There's also plenty projects that silently fix security bugs without issuing a CVE or even labelling them. So now the maintainer of that packages has to monitor the commit logs, figure out if a particular bug fix has security implications and then backport it to the older version which is becoming harder and harder over time.
Unless you have a massive team or a big enough army of volunteers, the LTS model is becoming less and less viable over time, you are often safer on rolling release or close to it (something like Fedora's pace is good).
There's no silver bullets here.
Which is why the whole process is open sourced and you can get easily the source version of a package, edit it and rebuild it.
Because it's a trade-off, just like stability is, they're both software bugs in the end so mitigating them has similar pros and cons.