I think you're right that cutting edge carries the risk of introducing new vulnerabilities that haven't been observed yet. And the closer you are to release, th

I think you're right that cutting edge carries the risk of introducing new vulnerabilities that haven't been observed yet. And the closer you are to release, the less time the security community has had to look into it. Conversely, there's also a factor that says that after some time, the security community will stop looking at a specific version. Even if that version still has vulnerabilities. Those two factors lead me to believe there's some sort of sweet spot. You probably don't want the cutting edge newest version, but you still want a version new enough that it's in widespread use.