Is this really problematic from a security perspective? Presumably anyone malicious is already running a script-kiddie package that is actively probing for vuln

Is this really problematic from a security perspective? Presumably anyone malicious is already running a script-kiddie package that is actively probing for vulnerabilities, so would it even help such an actor to know what library versions you're using?