As far as I know, that's wrong? You must "target" newer OS versions (to prevent loopholes as you mention), but you can still have whichever "min" OS version you want.