"From that prior experience, we assumed distros had ways to learn about upstream security-critical bugs. We never needed to notify them explicitly before."
Which roughly translates as : "We know nothing of how the linux dev ecosystem works and do not care."