case by case

I have patched skladnik (kde games) to work on touchscreens. The patches have all been accepted upstream, but after several months, and at this moment are not released. So on Debian trixie the game is playable on a phone, but not on anything else at this moment.

I presume most upstreams won't bother with cves, so there's that problem, that might be insignificant or important depending on how exposed that particular software is.