There's a lot more nuance there, but my summary would be: pax team created grsecurity patches which are awesome, they come as a big bundles rather than separate patches for each part, and are a bit disruptive - you need to know why you want them / are they worth it. Upstream doesn't want huge bundles, pax doesn't want to invest time in splitting them up and fighting with upstreaming each one separately. There's some external effort in the last years to chip away the most important ones, (KSPP, Popov Kees) but it's slow. In the meantime pax provides grsecurity as consultancy.
