Debian includes ffmpeg, for example, in the main stable repo. Given Debian’s reputation, I would think they are including these security patches in a timely manner, though I’m not entirely sure how to compare specific patches to verify this.
Of course, everything changes when you are selling support contracts. Canonical and Red Hat are the big two for enterprise because they provide support.
When I was last running Ubuntu on desktop, I signed up for an account and enabled these extra security updates. Yeah, it’s “free”, but it requires jumping through hoops. Requiring an account to get patches is the kind of user-hostile design pattern I expect from Apple or Google, but not in the desktop Linux world.