That part of "no one has to upgrade" is willful blindness. If they were for free choice they wouldn't have removed the option to change opreturn limit.

There will come a version that will make people upgrade for either a feature or a cve. They plan on it. That's why knots support is paramount.