> If you hesitate to fix security bugs out of fear of introducing new security bugs

I never say that. But maybe you just don't need to rewrite the whole project to fix some bugs? Sometime it is maybe the right answer but it should not be the default answer.