How Secure are OpenJDK Distributions?

Every Java release contains security patches. But how do they get there? And is there a difference between Oracle JDK, Oracle's OpenJDK, and AdopOpenJDK (soon Eclipse Adoptium)? Or the free or commercial offerings of companies like Amazon, Azul, etc.?

Martijn Verburg, among other things director at AdoptOpenJDK, will answer these questions and any others you may have.