That does happen with downversion software. Red Hat may distribute a backported patch to some component which isn't the same as Canonical or Debian's.

Most users, who don't know the answer to your questions, rely on the distro to figure this out (and often pay good money for it).

They already were in communication with each other. They could have come together and decided on one that mitigates the issues they've found.