Add on to that developers that use Dependabot or Renovate to automatically merge PRs with minor version bumps to "ensure the latest security patches are applied"