Anyone have details on how any of these required security updates will be forced to be anything more than an update to the version number? What's a "sufficient

Anyone have details on how any of these required security updates will be forced to be anything more than an update to the version number? What's a "sufficient" update? I can imagine companies just updating whatever models they want to but the older model updates just being cosmetic to save costs.