I haven't used php, but the situation described at that link is codependence.

  a: "Most of our users don't care about security."
  b: "OK then they can continue using old broken versions."
  a: "No, then they won't be secure! Therefore it must be easy to upgrade."
  b: "How?"
  a: "By not making the proposed security improvements."

This seems like a recipe for losing any users that do care about security, which is not a viable strategy over the long term.