I welcome updates that fix security vulnerabilities, but I view feature updates as a potential vector for introducing security vulnerabilities.

The difficulty is telling the difference between projects that rarely update because there aren’t any vulns, and projects that rarely update because they don’t care.