The reason they don't want to do anything other than security updates, and sometimes not even that, is because they need consistency across calculations over time.

This might be a poor example, but lets say an error was found in a computation in a library, for example a rounding error or something, in that case, more often than not, the community will rather live with the known error and have consistency instead.