People would rather use a functional but insecure tool than a broken secure one. No question. It's hard for devs to understand that for some reason.
Also they know when and why to update stuff they work on, thus i never happens at an inopportune time. Nor do they find themselves having to wrangle the new dependency kudzu they created, because for them it built up over time.