Largely my thought as well. Not having a kennel CNA would be far more problematic than the approach outlined for the Kernel CNA team.

Also if interpreted correctly it should help mitigate legal risks for EU companies that rely on Linux that update regularly.