What is the added value of a Linux distribution

Lets be completely honest though, there are also plenty of upstream projects who just never update their vendored dependencies at all, don't care about security issues or critical bugs in those dependencies and have a "works on my machine" attitude towards any reported problem, no matter how much detail is provided. Here distro packager do a lot of valuable work to test and make the software work on a wider set of systems and without introducing critical vulnerabilities to the user's systems.

Projects only using packaging that includes all dependencies like Docker images, flatpaks,... are particularly prone to not caring about any vulnerabilities in anything included in that packaging too.