There’s a strong link between code robustness and security: making it harder for any bugs to manifest makes harder for security flaws to manifest. The stable kernel releases (“bug fixes only”) each contain close to 100 new fixes per week. Faced with this high rate of change, a vendor can choose to ignore all the fixes, pick out only “important” fixes, or face the daunting task of taking everything. A vendor relying on cherry-picking is all but guaranteed to miss important vulnerabilities that others are actively fixing, which creates the illusion that security updates are being appropriately handled.”]
Source: https://security.googleblog.com/2021/08/linux-kernel-security-done-right.html