From TFA:

> Ubuntu Pro expands security coverage for critical, high and medium Common Vulnerabilities and Exposures (CVEs) to thousands of applications and toolchains, including Ansible, Apache Tomcat, Apache Zookeeper, Docker, Drupal, Nagios, Node.js, phpMyAdmin, Puppet, PowerDNS, Python 2, Redis, Rust, WordPress, and more.

So sounds like coverage of a bunch of stuff in their Universe repository that is not part of the base system.

Though I found my own thing to whinge about, on https://ubuntu.com/security:

> Ubuntu [...] includes access to:

> - ...

> - Knowledge Base: a private archive of expert-written articles and tutorials

Wait what?