This is why CVEs have severity ratings
> And if two "important" ones come out two days
Yes
> running through the QA pipeline
This is also why customers evaluate the CVE and their risk. The company I work for skipped a patch for a CVE because it was for areas that we don't use and weren't exposed to the public internet.
A lot of people don't reboot their systems. They build new ones, shift workloads and traffic over, and decommission the old ones. I can do that multiple times a day if required with no disruption of services.
You don't have to stay patched if you judge the risk doesn't make it worth it, but Ubuntu is pretty much the only distro that made the choice for you.