Security vulnerabilities should be fixed by patches/security fixes w/o forcing users to go up the ladder to "za niu anz shaini version" + "our new and enhanced x$/mo"
With that said it can get problematic fixing old third party packages that are no longer supported.