DevSecOps case study 2:

Most 3rd party vendors no longer publish packages for unsupported distros.

So if your client is on Ubuntu Trusty 14.04 that has been out-of-support for the last year, and even if they pay extended support (ESM), you are either stuck to Nginx 1.4.6 from ESM that should in theore get patches from ESM, or to Nginx 1.14 from Nginx but no longer receiving any patches for a year or so.