[Golden Eagle]

It's unfair to any vendor to lump vulnerabilities in all software onto the OS.

No it's not, if the vendor shipped it as part of their O/S "distribution", and the user is subsequently dependent on that O/S vendor for a compatible patch. Patches for what you want to call "3rd party" are only compatible if they come from the linux distro vendor, hence, it's a linux distro hole.

[Golden Eagle]

should have been: Patches for what you want to call "3rd party" are often only compatible if they come from the linux distro vendor, hence, it's a linux distro hole.