What's your definition of "working"? To some people, a system with a security vulnerability isn't "working".

I believe the phrase "things that people already use" answers your question.

> To some people, a system with a security vulnerability isn't "working".

Yes, we have seen that argument more than a few times before, usually from someone justifying their personal agenda without regard for its impact on other people, despite the availability of less disruptive options. Ego is a funny thing.

Obviously, there are times when lack of immediate action would have dire consequences, but I think it would be disingenuous to claim that was the norm, or to claim that this Chrome change is an example.

It's funny, because for people who care a lot about security engineering, "my system should continue running as it is even if it exposes its users to preventable security threats" also sounds pretty "egotistical".

It really doesn't. Either the system is working, or it isn't. People might be using it, but people use all sorts of broken systems.

It is indeed worth weighing the cost of making a breaking change, but given that it happens all the time in all sorts of projects, it's clear that only very few projects subscribe to your notion that breaking users are an absolute sin.

Even Linux has broken userspace programs when fixing bugs. It's only happened a few times, but it happens.