> use cases of the 0.1% who are actually going to receive the patches

It seems highly unlikely. They are not writing custom ordered security patches. They are selling general security support to whoever can afford it.