A turning point for CVE numbers

Why is a kernel upgrade disruptive? That seems like an indication that the application doesn’t have proper clustering support. Obviously, that’s quite possible, but my understanding is that best practice nowadays is to ensure that rebooting a server is just not a bug deal.

There are obviously many exceptions to this (HPC and embedded systems come to mind), but this seems to be the general rule. As far as stable kernel releases breaking stuff, is that something that should be caught in testing, preferable before the new stable tree is released?