Major advantage of Fedora is being closer to the upstream sources, both in terms of freshness and in terms of not meddling with libs or similar. Debian patches lead to several possible exploits over the last few years.
Yes, distributing non-free, patented code that requires a license, requires a license. The same goes for Debian actually[1], including blocking requests and removing packages that were included before by mistake.
I would even dare say that this is another point for Fedora, enabling
https://rpmfusion.org/ is a one-liner and feels entirely native, never a broken package.
I have to admit that I never compiled a list of this type and it seems exceedingly difficult to find useful search results. I couldn't dig up the examples I had in mind from the last 2 years, but stumbled upon others I didn't know of yet in turn, e.g. RCE via Redis, no special config required:
> This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking
