Comment by traceroute66

> For example, they patch OpenSSH source code in a way that...

Isn't it the same thing with the RedHat downstreams ? (Not necessarily OpenSSH but other packages)

IIRC RedHat do all sorts of things to keep their gov / corp customers happy, also usually in the name of backwards compatability, all of which then end up in the downstreams.