Firefox has an LTS version which can be a baseline for features, but which receives security updates at the very least.
I don't know about, say, Chrome 80 line that would receive security fixes but not new features. I also think that would be against Google's interests to have such an LTS line, it would decrease the moat between it an other browsers.
With Firefox (ESRs are at 102 and even 52) and, to an extent, Safari (tied to iOS releases) there are non-arbitrary baselines, where you know what kind and size of the audience you additionally cover by staying away from newer features.
Also don't you have stats by version number, what is extra non-arbitrary about LTS?
Browsers are updated to fix the security vulnerabilities.
People upgrade to the latest version to get the security fixes.
If a person is using a browser that is years out of date, they are subject to a lot of security vulnerabilities in a piece of software that is constantly exposed to untrusted code.
Using an old browser is unsafe. If you encounter people using old browsers, you should strongly encourage them to do whatever they can to update their browser for their own good. If they do this, a nice side-effect is that you don’t have to support their older browser version.
It seems very easy to understand the logic here. What part don’t you grasp? Don’t support older versions => this pressures them to upgrade => upgrading is good for their security.
What's the connection to security vulns? How does that impact devs not using "a separate stylesheet to support everyone." or ignoring "progressive enhancement"?
Or what's the vulnerability explanation of hasOwn?
It seems it mostly decays quicker on some webby platforms that culturally don't care much about backwards compatibility