Do they really? If you do a cost benefit analysis on using older versions of software that work better for you, including the probability of exploitation of both the new[0] and old versions, you'll find that it very often doesn't work out. Besides which, if you're really concerned about it there are plenty of better ways to mitigate those threats like sandboxing.

[0] updates have been known to make software more vulnerable too you know.

This constant stay on latest and cross your fingers mentality has to go if we ever are to have more stable releases and interfaces (both UI and APIs) again.

Average app developer is clearly not trustable for keepimg a whole system secure (Zoom for a recent example). We have to go back to air gapping but do it on app and even internal component level instead of whole machine. Sandboxing and containers is the only way forward.

What types of security vulnerabilities could apps like LibreOffice or Photoshop have?

Programs that manipulate binary files are common vectors for attacks. A malformed file can trick even well-written and well-tested parsers into executing code that they shouldn't, or corrupting aspects of the user's environment.

For example, cvedetails.com, some random website I found from Googling, lists 13 vulnerabilities for Photoshop and 31 for Libreoffice in the last few years.

There have been plenty of attacks targeting image and document viewers/editors over the years. It's a great vector, because recipients are more likely to open a document than run an executable.

Some of the very "best" vulnerabilities of all time have been attacks taking advantage of scripting features in Office.

https://www.securityfocus.com/bid/109374 just recently.