[rlpb]

A common misconception is that just because an upstream released some time before a distribution release, the distribution ought to have had enough time to update, and a failure to update is a failure on the part of the distribution.

But it doesn't work like that. Packages have reverse dependencies. Just updating PHP to 8.0 would have broken all reverse dependencies that didn't already support PHP 8.0. So it isn't just a case of shipping the newer version of PHP; all upstreams of reverse dependencies need to have shipped updated versions, too, and all of those need to have had their packaging updated.

In practice distributions patch support in to laggard reverse dependencies or even remove them to speed things up. But still, the actual work involved is much more than the naivety in the statement "PHP 8.0 was 10 months old yet Debian's 11 was released with PHP 7.4."

A second common misconception is that just because an upstream declares some kind of support period, distributions have to follow them or it's somehow a problem if they do not. Upstreams even having a declared support period is the exception, not the norm. Distributions have been declaring a support period for their release as a whole long before some upstreams started doing this.

[zxspectrum1982]

This is exactly why people pay for enterprise Linux distributions.