I'm on Comcast in USA, I BYOD for the router and it's a Netgear C3500 (I think). It gets new firmware pushed to it from Comcast. Can't even load your own manually.
Defintely seems potentially better than no updates at all.
How do you know if you have a wide open CVE they're ignoring, like it's claimed ubuntu are doing?
Perhaps better characterized as "buy your own device". Cable ISPs will only support a limited set of modems on their network, and they're fully managed by the ISP, both in terms of software and configuration.