Canonical already maintains security patches for paying customers so they aren't actually doing any extra work, but putting it behind a subscription both gives them an option to start charging more for desktops, gives clear cost for server use, and maybe is marketing for "look at the premium work we do".