Another example of the externalized cost of fixed release Linux distributions: Debian Bullseye (oldstable, LTS until August 2026) ships a root store that's years out of date.

Besides being a security issue, it slows down the entire TLS ecosystem.