Microsoft moved to a model where addressing security updates, non-security failures and feature enhancements in rolled together into one stream of change.
You need to look at your risks systematically. If you're a billboard provider, uptime matters, and you update when risks exist that you don't have other controls for. In an individual or corporate use case, ymmv. Some people want the bleeding edge all of the time. Other people want a stable user and application experience, and apply fixes for security or functional errata only.
People ultimately make choices. From what I see, many people are doing the stuff that matters to them to the perceived stability of their phone. Schools are increasingly Chrome-focused. Enterprises are still Microsoft, but they are spending too much on Windows.
That's not what running on master means. It means that all of your (many) security vulnerabilities are ones you don't know about[1] and random things keep breaking for no reason (and when you report them, it breaks in a way that's just different enough to let your bug report be closed as FIXED).
1: except (if you pay attention) the ones the developer advertises as 'features', like ssh with a default password of "password" baked into the kernel for "inventory management".
If you were an OS company and it were possible to force everyone to be running on master (and thereby not have any security vulnerabilities), wouldn't you, too?
But even then, this isn't true:
> It’s Windows latest or bust
Windows IoT Core is pretty stable. Wouldn't want your ATM or billboard rebooting every night. There are folks at Microsoft who remember how to do LTS software. They just don't think it's a good idea in a consumer product.