How many security issues spring from outdated packages vs packages updated too hastily?
How many security issues spring from outdated packages vs packages updated too hastily?
A newly-introduced security issue tends to have very limited exploitability, because it's valuable, not-yet well understood, and public exploits are yet to be developed.
Compare to that a similar vulnerability in an older package: chances are that everything about it has been learned and is publicly known. Exploits have become a commodity and are now part of every offensive security distro on the planet. If you run that vulnerable version, there's a real risk that a non-targeted campaign will randomly bite you.
Except in the scenario that is this exact case: Supply chain attacks that are developed with the exploit in mind.
For an old vulnerability, however, any unpatched system is a target. So the individual risk for the average unpatched system is still orders of magnitude higher than in the former scenario.