We'd rather spend time adding tangible value to our users (new scenarios, new features) than doing maintenance. BUT it can be argued a security issue -even if unlikely - could affect users, so we upgrade to keep our bar of no dependencies with Critical or High vulnerabilities.