Add note about distros backporting security fixes