The Nuxeo Platform development model is totally open. This means all the code source of the platform is available as open source software, from early development versions before a final release to further maintenance releases, which is a significant difference with other open source vendors.

However, to get direct and simple access to the maintenance service (which includes hot-fixes delivery) is part of the Nuxeo Connect subscription. Nuxeo's model is to derive revenue from maintenance, support and added value services (such as Nuxeo Studio) provided within a service subscription. One can always decide to go without subscribing to the Connect subscription as the source code is available as stated above, but this will be without the direct and simple access to hot-fixes, without any guarantee on support and maintenance, forward compatibility, nor the benefits of the other added-value services provided within Connect, and will probably generate additional costs and risks which makes it unsuited for professional use and enterprise-grade projects.

All Nuxeo releases are maintained for a long time.
Meaning, depending on their criticality for the community and our customers, bug fixes are backported on the source code maintenance branches (see branches 5.4.1, 5.4.2, …).
Looking at an issue on our tracking system, you can see the related fix, either download the attached patch files, compile the patch by yourselves, or download the corresponding jars from our public Maven repositories, and then manually deploy it on your server.

Hot-fixes are specific packages embedding those fixes, built by our support team at a high frequency (1~4 per month). This regular work takes time which is charged through the Nuxeo Connect subscription.

So, hot-fixes are free since the source code is open, the recipe to build them is documented and the binaries are freely downloadable.
But, the hot-fixes packaging you are talking about is a service, part of the charged support.
Finally, since we are releasing Nuxeo every three or four months, you will agree that getting automated backports between each release is an added-value, dedicated to our Connect subscribers.

Yes, the hotfixes are available at no charge. The subscription service provides a convenient mechanism to automagically manage application of the hotfixes, which otherwise you will have to apply manually.