The latest CUPS modification guarantees that the AppArmor profile is initialized prior to the initiation of the service, bolstering system protection across Ubuntu versions.
Under certain circumstances, CUPS could start before its AppArmor profile was loaded and therefore run unconfined