It's not a protection racket at all: you can go apply the patches yourself from upstream. See https://canonical.com/blog/open-source-security-with-ubuntu-....

> Alongside Ubuntu itself, each of these applications is fully security patched for high and critical CVEs for 10 years. This enables organisations to take advantage of a secure and stable open-source ecosystem with none of the usual maintenance burden! No need to worry about scanning, applying, and testing the latest upstream security updates.