Or relying on other people to report the issues so that people patch.

https://www.openwall.com/lists/oss-security/2017/01/24/4

The tone of discussion there indeed suggests a very lax / "meh" attitude towards vulnerabilities.