The reason for the "freeze version and backport security fixes only" is that users need to be absolutely confident that when they ask for security updates, nothing else will mysteriously break.
Yes, and what do you do when the security fix break something else and the distro choose not to backport the fixes to that problem?
That's certainly a risk, but it's less likely to happen than the alternative and all serious distributions have a QA process in place which is designed to catch those issues.