Personally I'm frequently rug pulled by breaking changes in patch updates.
Imo, semver is just a way for lazy devs to break backwards compat and feel ok about it.
Which would be fine if they maintained their old versions, which of course they don't, so what's the point of semver? All the breaking change version change means to me is you've forked your library and left me holding the bag.
I either have to update my code to accommodate your changes or I need to change your code to accommodate security issues.
And fuck me sideways if I have you as a peer dependency.