Or a reasonable security posture. Unless there is a vulnerability in the current version, why scramble to update? And if the author:

1. claims they do not have access to the signing account

2. Recently said that they are not planning any important release in the next 60 days

Then I would claim that rushing to update is plain reckless. But move fast and break things, I guess