> could have easily made it into the LTS versions had this one curious MS guy not noticed.

LTS doesn't mean set in stone. Debian publishes fixes within 24 hours in most cases, even if the upstream doesn't provide any, plus some packages come with Debian's own security patches on top of upstream patches.

Linux security landscape is very different than Windows' central "we'll patch it when we patch it" stance.