The number of reported security vulnerabilities has gone up drastically. And so has the frequency, number, and volume of security patches. Which also makes the gap between fully supported distributions and ones with only partial security support larger. (Not every distribution provides full security upddates for the full announced life time of a release.)
How are you folks reacting to this?
I just keep updating and patching, same as before. For big ones, like php2shell (before it was determined that it required a very specific setup), I check for signs of intrusion. But that’s still relatively rare. Just update.