How does that work in an ecosystem which is constantly releasing new major versions and not backporting security fixes to old majors?