Issues like this exist at all layers of the stack, so anything touching the internet needs regular security patches.
I agree completely. But, I also think that in most cases, if a simplistic piece of software like an IM app needs a security patch every three months, regularly, it's a sign the attack surface is too large.