What happens if there is a security problem in a package in the universe repository four years after the 12.04 LTS release; will the package be updated from upstream, patched, or left alone?

It's my understanding that the "5 years of support & security updates" applies only to the core of Ubuntu -- anything in Main repository. Not for things in the Universe repository.

For a more specific example -- if I install Ruby now, and want to use it for the next several years on 12.04 and it has a security vulnerability; while this might be patched in the upstream (so I could always download the latest from their website and compile it myself or use a PPA), will this upstream fix be migrated into the precise package repositories? What about backports?