Just make sure you update exa when there's a vulnerability in whatever got statically linked to it.