> Actually, i don't have enough time to do my day job, learn new technologies [...] > > Ergo, i cannot update. Ergo, companies cannot ship features AND handle

> Actually, i don't have enough time to do my day job, learn new technologies [...] > > Ergo, i cannot update. Ergo, companies cannot ship features AND handle all of the updates [...] Your time is limited and you can't get more of it. That isn't the case for a company. There, time == money, because if their employees don't have enough time to do all the work, they can just hire more to do the rest. But because they're only interested in growth and not sustainability, most of that money goes into developing new features, not keeping up with security updates. The vast majority of large companies could very easily hire one engineer and task them exclusively with updating legacy dependencies. And the smaller ones could instead re-task half their dev team for a month each year.