yeah, except that in practice, alot of "fast development" happens on platforms where engineers ignore updates that aren't explicitly flagged as security because the want a stable environment, then when the security bug hits, they push back on deploying the security fix because of breaking functional and API changes in the dependency. I have worked in a broad range of orgs from start-ups with 4 people to government, fin-tech, and bay area tech companies and every single one has had the same stumbling block that has been a pain in my ass as a person responsible for assessing and helping engineers ship secure software.