On a system where security is critical, I would probably need to re-evaluate my use of that software. It doesn't necessarily need to be the upstream developer,

On a system where security is critical, I would probably need to re-evaluate my use of that software. It doesn't necessarily need to be the upstream developer, it could be some other organization analogous to a distro maintainer. What matters is that someone who is familiar with the software and code base has actually tested the update in a purposeful way.