> ...distros run by volunteers (Debian, Arch, Alpine...) have shipped the fix. Meanwhile Ubuntu, made by a company that sells security subscriptions, hasn't.

This tells you all about the priorities of companies. It's making profit, not protecting their users. Perverse incentives and all that.