You're skipping over the part about users having to recheck what you serve them every request to see you haven't added a backdoor. Not sure how much security people being able to look at and pin versions with traditional software they build adds, but probably nonzero.