Depends when, before they hit the X.1.0, yes they do backport all security patches. I’d argue they actually do until .2.0, but that murkier.