> just remembering how software used to be three whole years ago causes me to shudder

Well, yes. I agree with that statement even though you made it facetiously. Backporting security fixes only for bugs that have made enough noise to warrant it is a horribly janky hack. And, just thinking about all the time that has been, in my opinion, wasted on custom code that Debian maintainers have had to write in order to backport fixes makes me shudder.