It's similar to why restic (backup software) has official, static, reproducible binaries in their releases.
RCE would have been worse than file system bugs, as it leads directly to a superset of problems including potentially losing all your files.
And if whatever library bugged, oh well, random people can access my systems ?
And if my bgpd bugged, oh well, we just inject random routes et forward data randomly ?
Makes no sense.
Relaxing library requirements can introduce security issues when the dependency behaviour changes, so I'm not sure what the argument is.
If your bgp is bugged, yeah it sucks, but it's recoverable. We're using encrypted traffic these days to ensure that even captured traffic is safe.
The difference here is that data corruption is not recoverable.