It's trivial to do when you know which binary to replace (and you have the source code available).

But it's probably not so trivial to hunt down every single old binary on every system. There's also a continuous risk that you may receive old binaries from third parties in the future.

For example, gitlab has started to ship a component written in Go in recent versions. Things like these are easy to forget about.