I can imagine no use case where ripping out features from upstream reduces risk vs adding it. I agree it makes no sense to stagnate, but I am familiar with the certified compiler space, and what I have described is exactly what I have witnessed. Compilers that are based on ancient versions of open source compilers, and have code incorporated from various point releases since then to minimize the amount of recertification necessary.