How is that any different than updating a Go app? If a security issue arises in an older version of Go, it doesn’t magically fix in your app until you recompile it.

Java also has a multi decade history of remaining backwards compatible across major version upgrades. Barring known exceptions for things explicitly being removed, I don’t see that changing.