We are in that period between when software was good enough and when software is certified as secure by the writers.
The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.
I hate to be the guy to complain about a free service (Ubuntu Pro is a source of revenue, but it's free for individuals) but if I knew this was actually was actually being offered I would (hopefully!) have switched off by now.
The Anthropic PoC used MPTCP, but the underlying bug does not need MPTCP to be enabled.
The TCP/IP stack has one of the most stable requirements bases of any component -- modern PCs can communicate with decades-old software and hardware, and the composition of layers design means the code can be easily tested, and is a great candidate for analysis via formal methods. And once you have a formally verified implementation, the stable requirements means you can make it safe and then leave it alone.
Network routing is complex enough from a management point of view, doing it fast and safely is very hard. Formal verification sounds nice, but the network stack is more than a dumb pipe.
For bugs like this, I hope the addition of Rust to the kernel will lessen the UAF vectors, but I'm sure it'll be years before that happens. The binder folks did a safe rewrite and encountered downstream companies hooking kernel tracepoints for state determination, I can't even begin to guess what they'll do to the network stack and how that'll affect adoption.
Of course, if one hides a bug long enough it will eventually disappear or become irrelevant.
Yes, indeed, WTF Ubuntu?