> This leads to a lot of ongoing maintenance work for the life of the project because eventually you get forced into newer minor and eventually major versions whether you like it or not.

Remember, the desire here is simply to keep up with security updates from dependencies. There is no customer requirement to be using the latest dependencies, but this approach requires you to eventually adopt them and that creates a bunch of work throughout the entire lifecycle of the project.