I'm working on a conference talk in which I will discuss the trade-offs inherent to long term releases.
Specifically: distributing software for a longer period than it is maintained upstream is very labor intensive, and different long-term systems approach the problem in different ways. RHEL starts with Fedora but removes ~90% of the packages and features in order to reduce the labor costs over the life of a release. Ubuntu similarly starts with Debian but splits repositories into a small "main" repo component that they promise to maintain and a large "universe" component that they document as merely a snapshot for which they do not promise any updates. Debian is probably effectively similar to Ubuntu, but they don't divide their repo the same way so it's hard to make any clear statements about user expectation of patch coverage over the distribution.
I am curious about how the maintainers of systems derived from Ubuntu LTS releases think about security risks and patch coverage.
Are there any packages in "universe" that are used in a default installation of your desktop? Do you monitor those packages for new CVEs?
Are there any packages in "universe" that you patch because your users would otherwise be at risk? Do you update those packages by backporting patches or by rebasing to new upstream releases?
Do you provide guidance to users about the packages they install from the Ubuntu "universe" repo collection using apt?
Do you recommend using software sources like Flatpak or Snap to give users access to application releases that are maintained and get security patches?
Is there anything else that you want users to know about your approach to vulnerability remediation or related security topics?
If this is not the best place to ask a question of the maintainers, where should I ask?
I think we need to address the underlying assumptions in your premise as they contain some errors.
Canonical officially maintains Main, while Universe is Community maintained. Jumping to a conclusion that this is unmaintained, incomplete, etc is misleading and inaccurate.
Since Ubuntu Pro was introduced, Canonical provides Expanded Security Maintenance (ESM Apps) for a large portion of Universe packages on LTS releases. It is not every package, but it is many thousands of them. Portraying Universe simply as an unmaintained snapshot reflects a model that is not the current reality.
Likewise, Debian Security and Debian LTS teams do provide security updates for many packages beyond what your wording implies.
Having set a premise that APT maintenance has supposed holes, this is followed by leading questions.
Rather than ask, "How do you approach software security?", instead, the questions lead with a series of assumptions.
Asking if Zorin OS provides "guidance to users about the packages they install from the Ubuntu "universe" repo collection using apt" is demonstrative of an agenda, bias or angle.
I can as easily ask these same style of leading questions:
How do you verify Flatpak runtimes receive timely security fixes?
What happens when an application maintainer abandons a Flatpak?
How are bundled libraries audited?
What risks arise from every application shipping its own dependencies?
How are Snap publishers vetted?
How are vulnerabilities handled when an upstream maintainer disappears?
A neutral speaker of Package Security would take this unbiased focus.
Now, you posted this on a Public Facing Forum, where the spirit of lively exercise and debate allow for critical examination of the merit of claims - and of being led to conclusions.
If you want to ask the Zorin OS Developers directly, you will want to use the Contact Us link from the Zorin page:
I didn't say that it was unmaintained, I said that universe is a "component that they document as merely a snapshot for which they do not promise any updates"
"Canonical does not provide a guarantee of regular security updates for software in the universe component, but will provide these where they are made available by the community. Users should understand the risk inherent in using these packages"
Does the Zorin project recommend that users sign up for Ubuntu Pro? Where can I learn more about that and other security recommendations?
Canonical tells Ubuntu users that they should have different security expectations of the "main" and "universe" repos.
Given your chosen wording. I did not write this.
Community Maintenance cannot be guaranteed by a separate party.
This, however, touches on your exact defined topic - and a third party being unable to vouch for a separate party does not mean a lack of security.
In other words - to say the unspoken parts aloud for you - Integrating a centralized system is not the goal of FOSS.
Indeed, were it to become that, the Age Verification trend would then be able to dictate GnuLinux as an Operating System and legally bind it to adherence.
The only route to counter what you quote (despite evidence lacking of security failures) is a centralized and standardized system like Microsoft.
On its face, this might be a one-off; except you lead this into a series of pointed directions favoring centralized and standardized package formats.
Snap and Flatpak.
No, they did not. They advise users to have different maintenance expectations. But that is a CYA measure. In reality, the Universe repository does not contain abandoned maintenance. It is a self cleaning system since a package that is present on Bionic, Focal, Jammy... then abandoned, simply cannot and will not get a Noble release file unless the Maintainer actively creates one (And therefor, did not abandon the project).
And LTS means that when they do; it is stably locked in.
I think it can be and that is fair and valid. That becomes an issue of legalize and word choice - which is notoriously difficult.
Another view would be that it is more broad: Risks can be security, but in this context, is broadly more about bugs, regressions or package conflicts which is, by far, a more prevalent issue.
A quick side-by-side example would be looking at the same statement - as if it were applied by Gnome in regards to Extensions.
A person may infer it means Security. And given your talk is on that very topic - your clear point of focus... But in general, it is about conflicting extension code and upkeep with upstream Gnome.
I would agree the analogy limps slightly but is a good way to give a clear perspective.