Every dependency you don’t update is a zero day waiting to happen. All software carries risk.

In the same breath you're advocating updating without checking, and saying why that's an issue. You ... realize that, right?

You're so close to realising the reason enterprise distros do backports.