Part of the issue might be with Debian ruling the OSL V1.1 (Magento is now under 3.0) as a non-free license. Conversations on the debian-legal mailing list went:
We did this one a few months back, but nobody raised the
patent/reciprocity thing at that time. Here's the offending clause:
10) Mutual Termination for Patent Action. This License shall terminate
automatically and You may no longer exercise any of the rights granted
to You by this License if You file a lawsuit in any court alleging
that any OSI Certified open source software that is licensed under any
license containing this "Mutual Termination for Patent Action" clause
infringes any patent claims that are essential to use that software.
I think this one's non-free too. It's certainly absurdly overbearing.
And more on that here.
It still seems to be GPL-incompatible because of the way it adds extra restrictions. I didn't think GPL compatibility was a necessity for universe inclusion, but Debian getting in a fluster over it will have stalled the upstream packaging process.
There's no reason why that should have stopped an Ubuntu user from packaging it. It just needs somebody who's willing to take up the task. I should add that this is not a one-off job. Security updates need to be pushed as soon as they're available.