Ubuntu 20.04’s PHP is 7.4. Ubuntu lists the fix as php7.4 7.4.3-4ubuntu2.29+esm5, in USN-8948-2, delivered through Ubuntu Pro Expanded Security Maintenance. Without that entitlement, apt will not see the package. Upstream 7.4.33 is not this update, and there is no Ubuntu tag that prints 7.4.34.
After the deb is installed, restart php7.4-fpm or apache2, matching the SAPI. Confirm the package version with apt-cache policy php7.4-fpm. php -v remaining on 7.4.3 is consistent with a backport.
Focal is a common legacy estate: WordPress and custom apps that never moved to 8.x. The ESM package is the in-place option Ubuntu offered. A migration to 22.04 or 24.04 is the longer fix and needs application tests. Consulting can sequence those two so the public vhost is not left on an unpatched 7.4 while the migration is designed.
If Pro is not available and you build PHP yourself, the 7.4 source backport branch exists. That is a build you must maintain, including extensions. It is not a shortcut around a broken apt source.