Isn't it obvious? Or do you suggest that end users should be responsible for checking and patching every package on their system? Given that Red Hat has a large department just to do that for RHEL, I can't imagine where end users would begin.
No, I’m suggesting that the authors of the applications are responsible for patching and distributing their own application like on every other major OS.