I don't get the logic behind the FFmpeg stance. They have no obligation to fix any bugs, and they are not liable if someone exploits those vulnerabilities, as per the license. Thus, the parties interested in fixes are free to patch bugs at their own expense or pay someone else to do it. Anyways, fixes will end up in the FFmpeg codebase or in other GNU-licensed fork of it, available to cherry-pick.