Security updates for the universe repository for LTS releases?

Security updates for the universe repository for LTS releases?

What happens if there is a security problem in a package in the universe
repository four years after the 12.04 LTS release; will the package be
updated from upstream, patched, or left alone?
It's my understanding that the "5 years of support & security updates"
applies only to the core of Ubuntu -- anything in Main repository. Not for
things in the Universe repository.
For a more specific example -- if I install Ruby now, and want to use it
for the next several years on 12.04 and it has a security vulnerability;
while this might be patched in the upstream (so I could always download
the latest from their website and compile it myself or use a PPA), will
this upstream fix be migrated into the precise package repositories? What
about backports?