TLDR: Ubuntu Pro offers additional security patches to packages found in the universe repo. Universe is community maintained so Ubuntu is essentially stepping in to provide critical CVE patches to some popular software in this repo that the community has not addressed.
I suppose it depends on how you look at it but I don’t really see this as withholding patches. Software in this repo would otherwise be missing these patches and it’s a ton of work for Ubuntu to provide these patches themselves.
Now is they move glibc to universe and tell me to subscribe to get updates I’ll feel differently.
I’ve had two Dell laptops that ran Ubuntu perfectly. Dell sells laptops with Ubuntu pre-installed and also certifies models for Linux. Their Linux support is top notch in my experience.