Are you saying you've had your PAM config broken by a package update when you didn't update anything in /etc, or that you had your PAM config broken by a package update where you blindly accepted changes to stuff in /etc?
Honestly, I hate Pam. It's one of the few pieces of software on Linux that desperately needs a replacement that isn't just a clone of the original. (nss also needs the boot)
If you want an idea of how bad things are, buy a copy of Michael W Lucas' FreeBSD Pam mastery...
Learned that lesson, oof. Taught me a few things about writing tests that I carry around with me though.
There were some discussions in systemd[1] about a protocol that would in future possibly provide a replacement for it if you are interested. Discussions have stalled and I am unsure why, but the thoughts do exist.