I think you might be misunderstanding what this is. This isn’t Canonical holding back freely-available updates to charge you money. This is Canonical doing additional work backporting fixes themselves. On any other distro with old ass packages, you’d be in the same spot just without the option of the ESM updates at all. Also Pro is free for like 5 or 10 machines for non-enterprise users so tell your boss to stop being a cheap ass if they care about security.