Absolutely not, that is the wrong answer. If a security-critical issue cannot be fixed without a breaking change, you make that breaking change. Anything else

Absolutely not, that is the wrong answer. If a security-critical issue cannot be fixed without a breaking change, you make that breaking change. Anything else is irresponsible, as is the desire of users to keep running insecure systems to avoid the effort of updating them.