The first sentence of "Coordinating a global response" is "Getting a fix into use can mean adapting it for older releases"... but I guess they mean "only supported releases", as the fixes only go back as far as 8.2, which still has security support until the end of the year, but nothing for 8.1 or 8.0, and in the case of PHP there are still plenty of PHP sites on 7.x and even 5.6.

I wouldn't expect the PHP team to provide patches for versions for which security support has ended. But this seems like the kind of task that AI is especially well suited for-- rework the patch for a release that is no longer supported but still widely used. It would've been nice for people who have much older sites to be able to patch their PHP rather than have to upgrade PHP as well to get the fix.