Linux Kernel Security Done Right (Google Security Blog)

Unfortunately, this leaves the externalities of security breaches via holes that were fixed, but not deployed. Until that starts getting factored in (via fines or actually punitive damages…not piddling amounts like $7.5M [1]), updates are always going to be "more risky" because companies put blinders on to the risk associated with staying on the current version. We have safety standards for infrastructure such as bridges, buildings, roads, etc. I really don't see why we completely ignore it for the infrastructure we've layered underneath everything else (as a society).

[1] https://arstechnica.com/gadgets/2021/08/google-class-acti...