If a security fix must break the API, you can bump up the SONAME which forces all packages depending on your shared library to recompile against the new version. This is comparable to the requirements under static linking, but you only have to do it when absolutely needed.