Eh, there's always the option of backporting fixes to of versions yourself if you really want, or, I guess, paying someone to do that. Or just run the old software and mitigate the risks in some other way - just not being a listening node is often pretty good.