You don't think software that's secure is important for both cases? Open up a random project with a language dependent package repository and tell me how many o

You don't think software that's secure is important for both cases? Open up a random project with a language dependent package repository and tell me how many of the packages are up to date? More often than not the answer is zero with commercial software. If you're running server side you should have test environments that match prod to be able to catch incompatibilities early.