I've (probably?) found more linker vulnerabilities than anyone else, but don't really understand your argument. I definitely understand library search path vulnerabilities (I've literally found bugs in $ORIGIN parsing, e.g. CVE-2010-3847 was one of mine!).

We think security updates don't break API/ABI because they're backported to all previous major versions that are still actively supported. This isn't "thoughts and prayers", it's work that the packagers and maintainers do. I can't tell you how useful being able to fix a vulnerability in every program is, just think of updating every application that uses libpng on your desktop, or every server application that uses OpenSSL.

I just can't imagine wanting to give that up, because of name mangling ABI issues!