While Canonical deserves the criticisms leveled by op (that I agree with), it's also incorrect to say that they lock security updated behind a paywall.

Anyone that does use Ubuntu gets security updated until they stop supporting that particular release version, which iirc is for six years (I may be wrong, thus is from memory).

If you want extended security updates for a specific version of the os, you can elect to sign up to Ubuntu pro without paying any money. You do have to make an account, and if you so choose you can populate the account info with garbage info and a disposable email, and you'll get extended security updates for that release version.