It's also about threat models, who you're trying to realistically protect yourself from. Some solo idiot with a political cause, not particularly targetting you? Waiting a week before using a new version is probably good enough. A government specifically targetting you? Likely nowhere near good enough. There's a lot in between of course.

>...Walmart talk on Node.js and how they vet every single update to every single module...

Most organizations are not as big as Walmart?

However, if the Walmarts/FANGS/etc with huge mega teams would publish their audited versions, that would be something. However, that seems like a liability without any potential gain for the mega teams.

In the hypothetical case all versions but the newest are vulnerable and the zero-day is also a problem in your specific deployment: manual tool validation is what should happen. Usually after a quick check if the package can be replaced easily.