If software updates/upgrades can be cleanly separated into security fix vs new features/removal of old features, then I think it may be reasonable for governmen

If software updates/upgrades can be cleanly separated into security fix vs new features/removal of old features, then I think it may be reasonable for governments to enforce mandatory patching. Unfortunately, software doesn't work like that. It's hard (if not completely impossible) to separate security from feature updates. You'll likely need to cherry pick git commits and build the software yourself. I don't know of any sane person who would spend the time to do that.