There are two degrees of separation here though: The software vendors and then the linux distros. If you sell software that requires your clients to upgrade th

There are two degrees of separation here though: The software vendors and then the linux distros. If you sell software that requires your clients to upgrade their system-wide security stack, so they might not. If it is statically linked, no need for them to.