They pull from Debian unstable every 6 months and that's it. Afterward, changes made in Debian mean nothing to Ubuntu.

Don't trust Ubuntu's LTS promises, either. Most of the modern packages you care about are in universe, which almost never gets patched after the initial release.

I think they deliberately leave the free LTS version insecure in order to sell Pro licenses. But guess what, even Pro doesn't get timely patches.