Red Hat refuses Alma's CVE patches to CentOS Stream; says "no customer demand"

It still requires a substantial amount of time to review the fix. Depending on the circumstances it might require more time to review a piece of code than to write it.