Even open source projects offer long term support. Why don't they at least fix security issues?