> This may also be partly related to Qt's security backports only existing on co...

> This may also be partly related to Qt's security backports only existing on commercial LTS branches and not the public LGPL branches.

The 5.15 LTS branch for QtWebEngine is still public: https://code.qt.io/cgit/qt/qtwebengine.git/log/?h=5.15.3 https://code.qt.io/cgit/qt/qtwebengine.git/log/?h=5.15

The 5.12 LTS (supported until the end of the year) also is public, for all of Qt.

Debian/Ubuntu just don't seem to care enough about security issues in QtWebEngine to keep it updated (it can be combined with an older version of Qt itself, so that wouldn't be an issue, at least in theory).