Backporting the fix is much lower effort in total. It's just a few dozen minor PHP releases that are affected, but millions of websites still running on older PHP versions.

Yes but it can't actually upgrade and release packages for discontinued distro release streams, that's a human problem.