The most terrifying part of this is all the devices that might be affected. Ignore servers and desktops. Linux 4.4 came out nearly 11 years ago. While most Linux devices' firmware is actually more ancient than that (Linux 2.x and 3.x isn't uncommon), any device that did ship with Linux 4.4+ is going to get hacked, because nobody patches those devices. Any smart device in the world that isn't a server, desktop, or microcontroller, is probably running Linux.

As part of the Software Building Code (that we don't have, and desperately need), one of the things we should have is mitigation for these abandoned internet safety risks. Here's how I would define that section:

  Section 4    Connections to Public Internet
  Section 4.1  Device Support
    Devices connected to the public internet WILL require one of the following:
      a) Guaranteed LTS support for a minimum of 10 years
      b) Guaranteed rolling release support for a minimum of 10 years
    Devices without this support are not permitted to be connected to the public internet.
  Section 4.2  Vendor Responsibility
    When releasing devices, vendors must determine whether this device is certified for
    public internet use. Support must be maintained according to S4.1. Failure to comply will
    result in fines of up to $5,000 per affected device.
  Section 4.3  Installer Responsibility
    Any device connected to the public internet which is not certified for public internet
    use is in violation, and will be subject to fines of up to $500 per affected device.
  Section 4.4  Device Owner Responsibility
    Any installed devices will be replaced once they reach their End Of Life period,
    or after 10 years, whichever comes first. Installed devices in use that exceed this
    period are in violation, and subject to fines of up to $250 per affected device.

(These fines are tiny compared to the fines for things like fire code violations, but enough money that a company, contractor, or individual would rather fix their device than pay the fines)