Credit Where Credit Is Due
Fixes [...] are available – if you have a Cisco service contract [...] If not, you'll have to ask the Cisco Technical Assistance Center really nicely.
Twice I was in the position where I had to seek security fixes for Cisco gear with lapsed SMARTnet agreements. Twice Cisco came up with the goods, though not after a protracted 20-30 minute phone call with the TAC each time.
I really am grateful that Cisco is committed to supporting even lapsed equipment, but I have always wondered why they don't simply dump their security updates on their website. By all means Cisco, place them behind a registration wall so that you can collect whichever metrics are of interest to you, but is dedicating TAC resources to this truly worth the cost?