Nobody is prevented from using newer versions of Bash. They just don't ship from Apple.
Brew? Well that has no signing support and no supply chain integrity. Hundreds of people have access to push whatever they want to a git repo and anyone is free to forge commits and backdoor all brew users as they like. It is worse than NPM.
At least on Windows you can install WSL and then get access to APT which checks RSA author signatures on everything regardless of mirror.
MacOS only provides signed packages via their app store. The end. If you want software they don't offer like a modern version of bash, you have to get it from untrusted sources like Brew that risk compromising your system.
download source code ./configure make sudo make install
seems to work for lots of software. By default it should install in /usr/local/<bin/lib> but I've done this for lots of OSS software (e.g. postgres and nginx) on Mac with few problems.
Yes, sometimes you have to pursue the odd missing dependency and build that too (e.g. openssl or readline), but I've always managed to build from source in the end without brew or (what's the other one called?).
No matter the risk, every engineer I know uses brew.
MacPorts is the other one and it at least uses some crude bulk openssl signing, but the higher barrier to entry means fewer packages so devs don't use it.
Was that good for bash?