Yeah, their lack of a satisfactory response is the final nail in their coffin. This incident escalates my consulting advice about Ubuntu from “not recommended” to “switch immediately”.
Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not been true for quite a while, they have now jumped the shark into eel-infested waters; I cannot take them seriously any longer.
The general advice I've been seeing the past ~8 years is "There is no reason to pick Ubuntu over Debian". I don't know who the opposite advice comes from and why anyone would pick ubuntu for a server.
Plain Debian was always best option; even RHEL dropped the ball on this CVE and that's distro people pay for support