Ubuntu is surely controversial but no, security updates aren't paid. ;) Well, unless you need an LTS that cannot be updated for whatever reasons for 10 years. Or for people that need an extra FIPS approval.