What's being missed here is there is a whole slew of vendors that support openjdk. Those patches will come from red hat, ibm, azul,.. as well.
The community will provide updates, but it this point no one knows what the eventual pattern will be which makes planning based on it difficult.
Azul publishes this as well: https://www.azul.com/products/azul_support_roadmap/
Cursory google searching is all it takes to find these things.